US20150074255A1 - SYSTEM AND METHOD FOR DATA CENTER SECURITY ENHANCEMENTS LEVERAGING MANAGED SERVER SOCs - Google Patents
SYSTEM AND METHOD FOR DATA CENTER SECURITY ENHANCEMENTS LEVERAGING MANAGED SERVER SOCs Download PDFInfo
- Publication number
- US20150074255A1 US20150074255A1 US14/334,178 US201414334178A US2015074255A1 US 20150074255 A1 US20150074255 A1 US 20150074255A1 US 201414334178 A US201414334178 A US 201414334178A US 2015074255 A1 US2015074255 A1 US 2015074255A1
- Authority
- US
- United States
- Prior art keywords
- management
- soc
- processor
- processors
- routing
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000000034 method Methods 0.000 title claims abstract description 36
- 239000004744 fabric Substances 0.000 claims abstract description 45
- 230000002093 peripheral effect Effects 0.000 claims description 5
- 238000007726 management method Methods 0.000 description 87
- 230000000694 effects Effects 0.000 description 9
- 230000001427 coherent effect Effects 0.000 description 8
- 238000001514 detection method Methods 0.000 description 8
- 101100059544 Arabidopsis thaliana CDC5 gene Proteins 0.000 description 5
- 101150115300 MAC1 gene Proteins 0.000 description 5
- 230000002776 aggregation Effects 0.000 description 5
- 238000004220 aggregation Methods 0.000 description 5
- 238000012550 audit Methods 0.000 description 5
- 230000008859 change Effects 0.000 description 5
- 238000012544 monitoring process Methods 0.000 description 5
- 238000004891 communication Methods 0.000 description 4
- 230000001010 compromised effect Effects 0.000 description 4
- 230000007246 mechanism Effects 0.000 description 4
- 238000012545 processing Methods 0.000 description 4
- 238000013459 approach Methods 0.000 description 3
- 238000013461 design Methods 0.000 description 3
- 230000002265 prevention Effects 0.000 description 3
- 235000008694 Humulus lupulus Nutrition 0.000 description 2
- 230000008901 benefit Effects 0.000 description 2
- 238000007689 inspection Methods 0.000 description 2
- 238000002955 isolation Methods 0.000 description 2
- 230000004044 response Effects 0.000 description 2
- 101150042248 Mgmt gene Proteins 0.000 description 1
- XUIMIQQOPSSXEZ-UHFFFAOYSA-N Silicon Chemical compound [Si] XUIMIQQOPSSXEZ-UHFFFAOYSA-N 0.000 description 1
- 241000700605 Viruses Species 0.000 description 1
- 230000004931 aggregating effect Effects 0.000 description 1
- 238000004458 analytical method Methods 0.000 description 1
- 230000002155 anti-virotic effect Effects 0.000 description 1
- 238000013475 authorization Methods 0.000 description 1
- 230000006835 compression Effects 0.000 description 1
- 238000007906 compression Methods 0.000 description 1
- 230000006837 decompression Effects 0.000 description 1
- 238000010586 diagram Methods 0.000 description 1
- 238000005538 encapsulation Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000001914 filtration Methods 0.000 description 1
- 230000006870 function Effects 0.000 description 1
- 230000006266 hibernation Effects 0.000 description 1
- 230000010354 integration Effects 0.000 description 1
- 239000000463 material Substances 0.000 description 1
- 238000013508 migration Methods 0.000 description 1
- 230000005012 migration Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000002085 persistent effect Effects 0.000 description 1
- 230000008569 process Effects 0.000 description 1
- 230000001105 regulatory effect Effects 0.000 description 1
- 230000011664 signaling Effects 0.000 description 1
- 229910052710 silicon Inorganic materials 0.000 description 1
- 239000010703 silicon Substances 0.000 description 1
- 238000000638 solvent extraction Methods 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
- 238000013519 translation Methods 0.000 description 1
- 238000013024 troubleshooting Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L49/00—Packet switching elements
- H04L49/10—Packet switching elements characterised by the switching fabric construction
- H04L49/109—Integrated on microchip, e.g. switch-on-chip
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/28—Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L45/00—Routing or path finding of packets in data switching networks
- H04L45/60—Router architectures
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L45/00—Routing or path finding of packets in data switching networks
- H04L45/74—Address processing for routing
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L49/00—Packet switching elements
- H04L49/30—Peripheral units, e.g. input or output ports
- H04L49/3009—Header conversion, routing tables or routing tags
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L49/00—Packet switching elements
- H04L49/35—Switches specially adapted for specific applications
- H04L49/351—Switches specially adapted for specific applications for local area network [LAN], e.g. Ethernet switches
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L49/00—Packet switching elements
- H04L49/35—Switches specially adapted for specific applications
- H04L49/356—Switches specially adapted for specific applications for storage area networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0209—Architectural arrangements, e.g. perimeter networks or demilitarized zones
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0227—Filtering policies
- H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1433—Vulnerability analysis
Definitions
- the disclosure relates generally to security aspects for data centers and in particular to data center security enhancements leveraging server systems on a chip (SOCs) or server switch fabrics.
- SOCs server systems on a chip
- FIGS. 1A and 1B show a classic data center network aggregation as is currently well known.
- FIG. 1A shows a diagrammatical view of a typical network data center architecture 100 wherein top level switches 101 a - n are at the tops of racks 102 a - n filled with blade servers 107 a - n interspersed with local routers 103 a - f . Additional storage routers and core switches. 105 a - b and additional rack units 108 a - n contain additional servers 104 e - k and routers 106 a - g FIG.
- 1 b shows an exemplary physical view 110 of a system with peripheral servers 111 a - bn arranged around edge router systems 112 a - h , which are placed around centrally located core switching systems 113 .
- a - bn arranged around edge router systems 112 a - h , which are placed around centrally located core switching systems 113 .
- Typically such an aggregation 110 has 1-Gb Ethernet from the rack servers to their top of rack switches, and often 10 Gb Ethernet ports to the edge and core routers. These typical data centers do not have good security.
- the idea of network security is well known.
- the terms used in field of network security may include deep packet inspection (DPI) and intrusion prevention systems (IPS) which are also known as Intrusion Detection and Prevention Systems (IDPS) and are network security appliances that monitor network and/or system activities for malicious activity.
- DPI deep packet inspection
- IPS intrusion prevention systems
- IDS intrusion detection system
- IDS intrusion detection system
- FIG. 2 shows a typical implementation of an IDS and IPS within a corporate network.
- the IDS is focused on detection, monitoring, and reporting of potential intrusions.
- the IDS is implemented out-of-line of the core network flow and is not invasive (located outside of the firewall and attached to a DMZ switch as shown in FIG. 2 ).
- the IPS adds the capability to prevent and block potential intrusion or undesired network flows and the IPS is implemented in-line of the core network flow.
- SoCs Typical systems of a chip
- SoCs have security features, such as security zones.
- ARM® processors and IP implement TrustZone as one layer of hardware, software, and system security. Further details of the TrustZone aspect of ARM® processors and IP can be found at http://www.arm.com/products/processors/technologies/trustzone.php and the materials located there are incorporated herein by reference.
- the security of the system is achieved by partitioning all of the SoC's hardware and software resources so that they exist in one of two worlds the Secure world for the security subsystem, and the Normal world for everything else.
- Hardware logic present in the TrustZone-enabled AMBA3 AXI bus fabric ensures that no Secure world resources can be accessed by the Normal world components, enabling a strong security perimeter to be built between the two.
- the second aspect of the TrustZone hardware architecture is the extensions that have been implemented in some of the ARM® processor cores. These extensions enable a single physical processor core to safely and efficiently execute code from both the Normal world and the Secure world in a time-sliced fashion. This removes the need for a dedicated security processor core, which saves silicon area and power, and allows high performance security software to run alongside the Normal world operating environment. However, these SOC security features have not been effectively extended to the security of a data center.
- FIGS. 1A and 1B illustrate a typical data center system
- FIG. 2 shows a typical implementation of an IDS and IPS within a corporate network
- FIG. 3 illustrates a high-level topology of a network aggregating system that may be leveraged for increased security in a data center
- FIG. 4 illustrates a block diagram of an exemplary switch of the network aggregation system that may be leveraged for increased security in a data center;
- FIG. 5 illustrates a network aggregation system with a network switch and enhanced security
- FIG. 6 illustrates a four-node server fabric with a network switch and enhanced security
- FIG. 7 illustrates a small three-node server fabric with a network switch and enhanced security.
- the disclosure is particularly applicable to a CalxedaTM server system on a chip and CalxedaTM switch fabrics as illustrated and described below with the security aspects and it is in this context that the disclosure will be described. However, the principles described below can be applied to other server-on-a-chip systems.
- a server-on-a-chip (SOC) with packet switch functionality is focused on network aggregation. It contains a layer 2 packet switch, with routing based on source/destination MAC addresses. It further supports virtual local area network (VLAN), with configurable VLAN filtering on domain incoming packets to minimize unnecessary traffic in a domain.
- VLAN virtual local area network
- the embedded MACs within the SOC do have complete VLAN support providing VLAN capability to the overall SOC without the embedded switch explicitly having VLAN support.
- FIG. 3 shows a high-level topology 800 of the network system that illustrates XAUI (a well-known interface standard) connected SoC nodes connected by the switching fabric.
- XAUI a well-known interface standard
- Two 10 Gb Ethernet ports EthO 801 a and Ethl 801 b come from the top of the tree.
- Ovals 802 a - n are CalxedaTM nodes that comprise at least one computational processors and an embedded switch. Each node may have five XAUI links connected to the internal switch. The switching layers use all five XAUI links for switching.
- XAUI node
- 10 Gb Ethernet 10 Gb Ethernet
- PCIe 10 Gb Ethernet
- SATA Serial Advanced Technology Attachment
- Topology 800 has the flexibility to permit every node to be a combination computational and switch node, or just a switch node. Most tree-type implementations have I/O on the leaf nodes, but topology 800 let the I/O be on any node. In general, placing the Ethernet at the top of the tree (the Ethernet ports) minimizes the average number of hops to the Ethernet.
- the system and method also supports a routing using a tree-like or graph topology that supports multiple links per node, where each link is designated as an Up, Down, or Lateral link, or both, within the topology.
- each node in the system may be a combination computational/switch node, or just a switch node, and input/output (I/O) can reside on any node as described below in more detail.
- the system may also provide a system with a segmented Ethernet Media Access Control (MAC) architecture which may have a method of re-purposing MAC IP addresses for inside MACs and outside MACs, and leveraging what would normally be the physical signaling for the MAC to feed into the switch.
- the system may also provide a method of non-spoofing communication, as well as a method of fault-resilient broadcasting, which may have a method of unicast misrouting for fault resilience.
- a data center with the CalxedaTM server system on a chip may be implemented using the set of fabric connected nodes with Ethernet uplinks as shown in FIG. 3 .
- Each node may be one or more Calxeda server boxes each of which has at least one CalxedaTM server system on a chip.
- the system may also provide a rigorous security between the management processor cores, such that management processors can “trust” one another.
- management processors can “trust” one another.
- there is a management processor core within each SoC (block 906 , FIG. 4 ).
- the software running on the management processor is trusted because a) the vendor (in this case CalxedaTM) has developed and verified the code, b) non-vendor code is not allowed to run on the processor. Maintaining a Trust relationship between the management processors allow them to communicate commands (e.g. reboot another node) or request sensitive information from another node without worrying that a user could spoof the request and gain access to information or control of the system.
- the management processor, block 906 is running an embedded OS, while the multiple processor cores represented by block 905 are more typically running a standard operating system, such as Linux.
- the management processor would typically use one of the Ethernet MACs, in this case block 907 , while the main processors, block 905 , would utilize the remaining Ethernet MACs, in this case blocks 902 and 903 .
- Each routing header unit 901 that may be implemented as a processing unit or processor, prepends routing headers to layer 2 Ethernet frames to form a routing frame going into the fabric switch, and removes the routing headers as they leave the switch and enter standard Ethernet MACs.
- the routing frame is composed of the routing frame header plus the core part of the Ethernet frame, and is structured as shown in Table 1, below:
- routing frame header typically consists of the fields shown in Table 2, below:
- the Routing Header processor 901 contains a MAC Lookup CAM (Content Addressable Memory) (MCAM), macAddrLookup, that maps from 6 byte MAC addresses to 12-bit Node IDs, as shown in Table 3, below.
- MCAM Content Addressable Memory
- the approach to security domain management in the system and method disclosed here is as follows: Support multiple domain IDs within the fabric. Allow each of the MACs within a node (management processor, MAC0, MAC1, Gateway) to be assigned to a domain ID individually (and tagged with domain 0 if not set). Allow each of the MACs within a node to have a bit indicating access to the management domain.
- the domain IDs associated with a MAC could only be assigned by the management processor, and could not be altered by the A9.
- the routing frame processor would tag the routing frame with the domain ID and management domain state associated with that MAC.
- Domains would provide the effect of tunnels or VLANs, in that they keep packets (both unicast and multicast) within that domain, allowing MACs outside that domain to be able to neither sniff or spoof those packets. Additionally, this approach would employ a five-bit domain ID. It would add options to control domain processing, such as, for example, a switch with a boolean per MAC that defines whether packets are delivered with non-defined (i.e., zero) domain ID, or a switch that has a boolean per MAC that defines whether packets are delivered with defined (non-zero) but non-matching domain IDs. A further option in the switch could turn off node encoded MAC addresses per MAC (eliminating another style of potential attack vector). Each of these options described in this paragraph are options that are implemented in the fabric switch, controlled by bits in the control status registers (CSRs) of the fabric switch. Software initializes the CSRs to the desired set of options.
- CSRs control status registers
- the management domain bit on all management processor MACs could be marked.
- the management processor should route on domain 1 (by convention).
- domain 1 by convention.
- Such a technique allows all the management processor's to tunnel packets on the management domain so that they cannot be inspected or spoofed by any other devices (inside or outside the fabric), on other VLANs or domains.
- a gateway MAC that has the management domain bit set could be assigned, keeping management packets private to the management processor domain.
- the switch fabric could support “multi-tenant” within itself, by associating each gateway MAC with a separate domain.
- each gateway MAC could connect to an individual port on an outside router, allowing that port to be optionally associated with a VLAN. As the packets come into the gateway, they are tagged with the domain ID, keeping that traffic private to the MACs associated with that domain across the fabric.
- Unicast routing is responsible for routing non-multicast (i.e. unicast) packets to the next node. This is done by utilizing a software computed unicastRoute[ ] next node routing table that provides a vector of available links to get to the destination node.
- the above server fabric and switch fabric can benefit by enhanced security and a number of techniques to leverage and extend upon server interconnect fabrics that have some or all of the characteristics described above to dramatically improve security within a data center are described.
- the different embodiments implement “packet processing” which may include a wide range of packet processing including, but not limited to: IDS functionality, IPS functionality, sFlow monitoring (wherein sFlow is a specification for monitoring computer networks set forth in an sFlow specification that is RFC 3176) Packet routing or bridging between networks, Deep packet inspection, Packet logging, Transparent VPN encapsulation, Packet encryption/decryption and/or Packet compression/decompression.
- packet processing may include a wide range of packet processing including, but not limited to: IDS functionality, IPS functionality, sFlow monitoring (wherein sFlow is a specification for monitoring computer networks set forth in an sFlow specification that is RFC 3176) Packet routing or bridging between networks, Deep packet inspection, Packet logging, Transparent
- a first embodiment relates to the use of management processor for out-of-band security.
- the integration of a separate management processor within the same SoC as the core application processors enables new classes of security.
- the enabling attributes of the management processor include:
- Management processor running within Secure world security zone.
- Application processor running in Normal world security zone, although underlying secure hypervisors on the Application processor may have the ability to run in Secure world.
- the management processor by running in Secure world has complete access to all the resources of the SoC including:
- This technique allows the management processor running in Secure world to provide Out-of-Band (OOB), as seen by the application processors, communication between nodes to facilitate security/integrity monitoring services.
- OOB Out-of-Band
- management processors on different nodes can compare portions of the DRAM on their nodes to identify unexpected changes to memory regions that are expected to not vary over time.
- This OOB peek mechanism could be used to facilitate malware detection from a central location utilizing a management controller that just answers requests to fetch portions of memory, offloading the analysis to a computer with more resources.
- the application processor can request the management processor to verify the authenticity of some code before running it. This should be more secure than white-listing code running in the kernel on the application processor, which is the current technique being used.
- the second embodiment relates to the isolation of nodes that have been security compromised or are malfunctioning. There are cases where, though other known techniques not described herein, a determination has been made that a node needs to be isolated, including:
- a security violation has been detected on a node, including a compromised OS kernel, a root kit, or a damaging virus.
- Compromise detection is software driven, can come from any source including failures in remote attestation, malware detection, IPS/IDS built into the fabric, or external, manual operator control, management processor DRAM monitoring as discussed in Disclosure 9, and by other known means.
- the management processor can power off the application processor, or the offending peripheral.
- the management processor can alter the security zone settings to software isolate the offending device or processor.
- the management processor can alter the fabric MCAM, routing tables, or gateway node IDs to prevent the fabric from emitting potentially compromised packets into the fabric.
- the third embodiment relates to the use of the management processor to provide controller/device virtualization for the application processors.
- the management processor can be used to provide controller or device virtualization for the application processor for both local and remote devices using the following technique:
- Use TrustZone or similar security zones to block access to a device from the application processors, and then have the application processor communicate to the management processor to access it.
- the application processor could send a NAND read request to the management processor via IPC (Inter-Processor Communication channel), the management processor could approve or disapprove it, and then forward the request to the NAND controller protected in Secure world.
- the management processor can then return the status of the request to the application processor via IPC. This mechanism can be similarly used for other forms of access control and logging.
- a network firewall, IPS, or IDS can also be implemented via this technique.
- the management processor can inspect packets before forwarding them to a MAC that is protected via Secure World.
- TPM Trusted Platform Module
- the management processor can take advantage of the server fabric when deciding what to do with requests to access devices—request remote authorization for example.
- the management processor could log requests either locally or remotely.
- the fourth embodiment relates to using the management processor to provide a secure logging path since keeping logs secure for audits is a significant aspect of most regulatory/financial compliance requirements. This can be accomplished using the following technique:
- the application processor would rely on logging to local storage, network storage, or communicating logging data to a remote server. With this technique, the application processor can send log messages securely to the management processor.
- the logging mechanism of the management processor is thus completely decoupled and secured from the application processor.
- the management processor then has multiple options for persisting the secured logging, including:
- the fifth embodiment relates to the use of the management processor to provide a secure auditing path. Instead of relying on the main network domain to the application processor to perform audits of systems, this technique will utilize the management domain to secure the audit processes.
- part of an audit may be to perform a port scan of a system. This is relatively low bandwidth—instead of talking directly to the application processor over its normal data path, the request can be proxied via the management processor in a network-proxy type fashion.
- the management processor can do this is a ‘dumb’ method, using techniques such as SNAT (secure network address translation) to ensure the responses are routed back through the management processor instead of out over the fabric.
- SNAT secure network address translation
- the management processor can have local auditing control.
- An example of this implementation may include responding to a port scan request and generate the port scan traffic itself.
- An additional example is logging in via ssh to verify logs, file integrity, permission integrity, or similar auditing tasks.
- the sixth embodiment relates to the use of the management processor to provide out-of-band (OOB) network access to the application processor.
- OOB out-of-band
- This technique extends the technique described above by using the management processor as a NATing router using the following technique:
- An application processor may use a Ethernet controller (say MAC0) to communicate in its main ‘data path’—traffic sent out it is routed out via the fabric like normal, at line rate, not touched by the management processor.
- MAC0 Ethernet controller
- An application processor can further use a second Ethernet controller (say MAC1) to communicate with external hosts via the management processor.
- a second Ethernet controller say MAC1
- An extra MAC address can be associated with a node's management processor's MAC port so that any traffic sent to either of two MAC addresses goes to that port.
- One of the MAC addresses can be used for normal IP traffic for the management processor.
- the other can be recognized by special software on the management processor as being destined for the application processor.
- the management processor can then do a NAT type change of the destination MAC address of the packet so that the fabric switch will route it to MAC1, where the application processor will receive it. It can also change the source MAC address to the original destination MAC address of the packet, so that a response to the source MAC address will also be directed to the management processor's MAC.
- the application processor side won't need any special software to support this.
- the seventh embodiment relates to dynamic security zones for direct memory access (DMA) masters.
- DMA direct memory access
- the DMA Masters including independent DMA controllers as well as those found embedded in peripheral IP such as disk and ethernet controllers, are configured to either respond to the Secure world or the Normal world. IP vendors either hardwire this setting and don't allow you to change it, or offer a parameter to set it one-way permanently.
- IP vendors either hardwire this setting and don't allow you to change it, or offer a parameter to set it one-way permanently.
- the following technique extends the fixed relationship of DMA Master's to security zones:
- a security zone register is added between the internal SoC fabric and each DMA master.
- the security zone register is itself protected in Secure world so that untrusted master's can change it.
- the security zone register provides the current security zone to the internal SoC fabric for that transaction.
- the eighth embodiment relates to secure boot-loading of the application processor by the management processor.
- the management processor can bootstrap the application processor by preloading the application processor's boot-loader into DRAM prior to releasing the application processor from reset. This allows the management processor to completely control the contents of the application processors boot-loader, including whether or not the application processor exits secure world immediately and permanently, whether the application processor can selectively enter secure mode, and which interrupts it can service in secure mode only. It also allows the application processor's boot-loader to be cryptographically verified prior to loading it, to ensure the integrity of the boot-loader, or to insure the boot loader was signed by a proper authority.
- the management processor can use its secure management fabric domain to source the application processor's boot-loader dynamically on demand, or can retrieve new versions of it that can be stored in local non-volatile memory.
- the ninth embodiment relates to DMA master configurable coherency.
- a DMA master is designed to be either cache-coherent, or non-coherent. This design usually includes the following characteristics:
- the DMA master is connected to a cache-coherency controller.
- the DMA master would be connected via AXI to the Accelerator Coherency Port.
- the DMA master is connected via the SoC internal fabric directly to the memory subsystem, bypassing the caching subsystem.
- a DMA master may be dynamically configured as either coherent or non-coherent using the following technique:
- a software controlled multiplexer may be defined to map the DMA Master to either a coherent port on the cache coherency controller, or directly to the memory subsystem, bypassing the caching subsystem.
- Software controlled register over-rides any hardwired cacheability settings found in the DMA Master IP, so cacheability can be altered when switching between the coherent and non-coherent configuration.
- the cache-coherent and non-coherent interfaces to a DMA controller can affect both the ease of writing the device driver and the resulting performance. But, these tradeoffs can vary by operating system, implementation of the device driver, as well as the devices connected to the DMA master.
- This technique allows a specific hardware/software/system implementation to be optimized at boot-time, rather than hard-wiring the DMA Master coherency decision at SoC design time.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
Description
- This application is a Continuation of U.S. application Ser. No. 13/475,722, filed May 18, 2012, which claims priority from Provisional U.S. Application 61/489,569, filed May 24, 2011; U.S. application Ser. No. 13/475,722 is also a Continuation-In-Part of U.S. application Ser. No. 12/794,996, filed Jun. 7, 2010, which claims priority from Provisional U.S. Application 61/256,723, filed Oct. 30, 2009, all of which are incorporated herein by reference in their entirety.
- The disclosure relates generally to security aspects for data centers and in particular to data center security enhancements leveraging server systems on a chip (SOCs) or server switch fabrics.
-
FIGS. 1A and 1B show a classic data center network aggregation as is currently well known.FIG. 1A shows a diagrammatical view of a typical network data center architecture 100 whereintop level switches 101 a-n are at the tops ofracks 102 a-n filled withblade servers 107 a-n interspersed withlocal routers 103 a-f. Additional storage routers and core switches. 105 a-b andadditional rack units 108 a-n containadditional servers 104 e-k androuters 106 a-gFIG. 1 b shows an exemplary physical view 110 of a system withperipheral servers 111 a-bn arranged aroundedge router systems 112 a-h, which are placed around centrally locatedcore switching systems 113. Typically such an aggregation 110 has 1-Gb Ethernet from the rack servers to their top of rack switches, and often 10 Gb Ethernet ports to the edge and core routers. These typical data centers do not have good security. - The idea of network security is well known. The terms used in field of network security may include deep packet inspection (DPI) and intrusion prevention systems (IPS) which are also known as Intrusion Detection and Prevention Systems (IDPS) and are network security appliances that monitor network and/or system activities for malicious activity. The main functions of intrusion prevention systems are to identify malicious activity, log information about said activity, attempt to block/stop activity, and report activity. The network security may also utilize an intrusion detection system (IDS), which is a device or software application that monitors network and/or system activities for malicious activities or policy violations and produces reports to a Management Station.
-
FIG. 2 shows a typical implementation of an IDS and IPS within a corporate network. In the typical implementation, the IDS is focused on detection, monitoring, and reporting of potential intrusions. As such, the IDS is implemented out-of-line of the core network flow and is not invasive (located outside of the firewall and attached to a DMZ switch as shown inFIG. 2 ). The IPS adds the capability to prevent and block potential intrusion or undesired network flows and the IPS is implemented in-line of the core network flow. - Typical systems of a chip (SoCs) have security features, such as security zones. For example, ARM® processors and IP implement TrustZone as one layer of hardware, software, and system security. Further details of the TrustZone aspect of ARM® processors and IP can be found at http://www.arm.com/products/processors/technologies/trustzone.php and the materials located there are incorporated herein by reference. The security of the system is achieved by partitioning all of the SoC's hardware and software resources so that they exist in one of two worlds the Secure world for the security subsystem, and the Normal world for everything else. Hardware logic present in the TrustZone-enabled AMBA3 AXI bus fabric ensures that no Secure world resources can be accessed by the Normal world components, enabling a strong security perimeter to be built between the two.
- The second aspect of the TrustZone hardware architecture is the extensions that have been implemented in some of the ARM® processor cores. These extensions enable a single physical processor core to safely and efficiently execute code from both the Normal world and the Secure world in a time-sliced fashion. This removes the need for a dedicated security processor core, which saves silicon area and power, and allows high performance security software to run alongside the Normal world operating environment. However, these SOC security features have not been effectively extended to the security of a data center.
- Thus, it is desirable to provide a data center security system and method that leverage server systems on a chip (SOCs) and/or server fabrics, and it is to this end that the disclosure is directed.
-
FIGS. 1A and 1B illustrate a typical data center system; -
FIG. 2 shows a typical implementation of an IDS and IPS within a corporate network; -
FIG. 3 illustrates a high-level topology of a network aggregating system that may be leveraged for increased security in a data center; -
FIG. 4 illustrates a block diagram of an exemplary switch of the network aggregation system that may be leveraged for increased security in a data center; -
FIG. 5 illustrates a network aggregation system with a network switch and enhanced security; -
FIG. 6 illustrates a four-node server fabric with a network switch and enhanced security; and -
FIG. 7 illustrates a small three-node server fabric with a network switch and enhanced security. - The disclosure is particularly applicable to a Calxeda™ server system on a chip and Calxeda™ switch fabrics as illustrated and described below with the security aspects and it is in this context that the disclosure will be described. However, the principles described below can be applied to other server-on-a-chip systems.
- A server-on-a-chip (SOC) with packet switch functionality is focused on network aggregation. It contains a
layer 2 packet switch, with routing based on source/destination MAC addresses. It further supports virtual local area network (VLAN), with configurable VLAN filtering on domain incoming packets to minimize unnecessary traffic in a domain. The embedded MACs within the SOC do have complete VLAN support providing VLAN capability to the overall SOC without the embedded switch explicitly having VLAN support. -
FIG. 3 shows a high-level topology 800 of the network system that illustrates XAUI (a well-known interface standard) connected SoC nodes connected by the switching fabric. Two 10 Gb Ethernet ports EthO 801 a and Ethl 801 b come from the top of the tree. Ovals 802 a-n are Calxeda™ nodes that comprise at least one computational processors and an embedded switch. Each node may have five XAUI links connected to the internal switch. The switching layers use all five XAUI links for switching.Level 0leaf nodes 802 d, e (i.e., NOn nodes, or Nxy, where x=level and y=item number) only use one XAUI link to attach to the interconnect, leaving four high-speed ports that can be used as XAUI, 10 Gb Ethernet, PCIe, SATA, etc., for attachment to I/O. The vast majority of trees and fat trees have active nodes only as leaf nodes, and the other nodes are pure switching nodes. This approach makes routing much more straightforward.Topology 800 has the flexibility to permit every node to be a combination computational and switch node, or just a switch node. Most tree-type implementations have I/O on the leaf nodes, buttopology 800 let the I/O be on any node. In general, placing the Ethernet at the top of the tree (the Ethernet ports) minimizes the average number of hops to the Ethernet. - The system and method also supports a routing using a tree-like or graph topology that supports multiple links per node, where each link is designated as an Up, Down, or Lateral link, or both, within the topology. In addition, each node in the system may be a combination computational/switch node, or just a switch node, and input/output (I/O) can reside on any node as described below in more detail. The system may also provide a system with a segmented Ethernet Media Access Control (MAC) architecture which may have a method of re-purposing MAC IP addresses for inside MACs and outside MACs, and leveraging what would normally be the physical signaling for the MAC to feed into the switch. The system may also provide a method of non-spoofing communication, as well as a method of fault-resilient broadcasting, which may have a method of unicast misrouting for fault resilience.
- A data center with the Calxeda™ server system on a chip may be implemented using the set of fabric connected nodes with Ethernet uplinks as shown in
FIG. 3 . Each node may be one or more Calxeda server boxes each of which has at least one Calxeda™ server system on a chip. - The system may also provide a rigorous security between the management processor cores, such that management processors can “trust” one another. In the example node 900 shown in
FIG. 4 (which is described below in more detail), there is a management processor core within each SoC (block 906,FIG. 4 ). The software running on the management processor is trusted because a) the vendor (in this case Calxeda™) has developed and verified the code, b) non-vendor code is not allowed to run on the processor. Maintaining a Trust relationship between the management processors allow them to communicate commands (e.g. reboot another node) or request sensitive information from another node without worrying that a user could spoof the request and gain access to information or control of the system. - Typically the management processor, block 906, is running an embedded OS, while the multiple processor cores represented by block 905 are more typically running a standard operating system, such as Linux. The management processor would typically use one of the Ethernet MACs, in this case block 907, while the main processors, block 905, would utilize the remaining Ethernet MACs, in this case blocks 902 and 903.
- Each routing header unit 901, that may be implemented as a processing unit or processor, prepends routing headers to
layer 2 Ethernet frames to form a routing frame going into the fabric switch, and removes the routing headers as they leave the switch and enter standard Ethernet MACs. The routing frame is composed of the routing frame header plus the core part of the Ethernet frame, and is structured as shown in Table 1, below: -
TABLE 1 Routing Header Prepended to Layer 2 FrameRouting Frame Header Ethernet Frame Packet RF Header MAC MAC Ethertype/ Payload CRC32 destination Source Length (data and padding) - The routing frame header (RF Header) typically consists of the fields shown in Table 2, below:
-
TABLE 2 Routing Header Fields Width Field (Bits) Notes Domain ID 5 Domain ID associated with this packet. 0 indicates that no domain has been specified. Mgmt 1 Specifies that the packet is allowed on the Domain private management domain. Source Node 12 Source node ID Source Port 2 0 = MAC0, 1 = MAC1, 2 = MAC_management processor, 3 = MAC_OUT Dest Node 12 Destination node ID Dest Port 2 0 = MAC0, 1 = MAC1, 2 = MAC_management processor, 3 = MAC_OUT RF Type 2 Routing Frame Type (0 = Unicast, 1 = Multicast, 2 = Neighbor Multicast, 3 = Link Directed) TTL 6 Time to Live-# of hops that this frame has existed. Switch will drop packet if the TTL threshold is exceeded (and notify management processor of exception). Broadcast 5 Broadcast ID for this source node for this ID broadcast packet. Checksum Checksum of the frame header fields. Total 46 +checksum - The Routing Header processor 901 contains a MAC Lookup CAM (Content Addressable Memory) (MCAM), macAddrLookup, that maps from 6 byte MAC addresses to 12-bit Node IDs, as shown in Table 3, below.
-
TABLE 3 MAC Address CAM (MCAM) MAC Lookup MAC Lookup CAM Input CAM Output Node Local MAC Address Node ID Port ID 1 bit 6 bytes 12 bits 2 bits - The approach to security domain management in the system and method disclosed here is as follows: Support multiple domain IDs within the fabric. Allow each of the MACs within a node (management processor, MAC0, MAC1, Gateway) to be assigned to a domain ID individually (and tagged with
domain 0 if not set). Allow each of the MACs within a node to have a bit indicating access to the management domain. The domain IDs associated with a MAC could only be assigned by the management processor, and could not be altered by the A9. For frames generated by MACs (both inside and outside), the routing frame processor would tag the routing frame with the domain ID and management domain state associated with that MAC. Domains would provide the effect of tunnels or VLANs, in that they keep packets (both unicast and multicast) within that domain, allowing MACs outside that domain to be able to neither sniff or spoof those packets. Additionally, this approach would employ a five-bit domain ID. It would add options to control domain processing, such as, for example, a switch with a boolean per MAC that defines whether packets are delivered with non-defined (i.e., zero) domain ID, or a switch that has a boolean per MAC that defines whether packets are delivered with defined (non-zero) but non-matching domain IDs. A further option in the switch could turn off node encoded MAC addresses per MAC (eliminating another style of potential attack vector). Each of these options described in this paragraph are options that are implemented in the fabric switch, controlled by bits in the control status registers (CSRs) of the fabric switch. Software initializes the CSRs to the desired set of options. - To keep management processor to management processor communication secure, the management domain bit on all management processor MACs could be marked. Generally, the management processor should route on domain 1 (by convention). Such a technique allows all the management processor's to tunnel packets on the management domain so that they cannot be inspected or spoofed by any other devices (inside or outside the fabric), on other VLANs or domains. Further, to provide a secure management LAN, a gateway MAC that has the management domain bit set could be assigned, keeping management packets private to the management processor domain. Additionally, the switch fabric could support “multi-tenant” within itself, by associating each gateway MAC with a separate domain. For example, each gateway MAC could connect to an individual port on an outside router, allowing that port to be optionally associated with a VLAN. As the packets come into the gateway, they are tagged with the domain ID, keeping that traffic private to the MACs associated with that domain across the fabric.
- Unicast routing is responsible for routing non-multicast (i.e. unicast) packets to the next node. This is done by utilizing a software computed unicastRoute[ ] next node routing table that provides a vector of available links to get to the destination node.
- Server Interconnect Fabric Security
- The above server fabric and switch fabric can benefit by enhanced security and a number of techniques to leverage and extend upon server interconnect fabrics that have some or all of the characteristics described above to dramatically improve security within a data center are described. The different embodiments implement “packet processing” which may include a wide range of packet processing including, but not limited to: IDS functionality, IPS functionality, sFlow monitoring (wherein sFlow is a specification for monitoring computer networks set forth in an sFlow specification that is RFC 3176) Packet routing or bridging between networks, Deep packet inspection, Packet logging, Transparent VPN encapsulation, Packet encryption/decryption and/or Packet compression/decompression.
- Use of Management Processor for Out-of-Band Security
- A first embodiment relates to the use of management processor for out-of-band security. The integration of a separate management processor within the same SoC as the core application processors enables new classes of security. The enabling attributes of the management processor include:
- Management processor running within Secure world security zone. Application processor running in Normal world security zone, although underlying secure hypervisors on the Application processor may have the ability to run in Secure world.
- The management processor by running in Secure world has complete access to all the resources of the SoC including:
- processor state of the application processor
- debug control of the application processor
- access to all memory and peripheral resources of the Soc
- This technique allows the management processor running in Secure world to provide Out-of-Band (OOB), as seen by the application processors, communication between nodes to facilitate security/integrity monitoring services. These innovations include:
- Since the management processor can access all SoC RAM, management processors on different nodes can compare portions of the DRAM on their nodes to identify unexpected changes to memory regions that are expected to not vary over time.
- This facilitates not only security use cases, but also a dynamic fault discovery use case.
- Live capture of a node's memory image, or parts of it, or signatures of it, for any purpose—troubleshooting, forensics, image migration, hibernation, by other management or application processors, or even by external systems. This OOB peek mechanism could be used to facilitate malware detection from a central location utilizing a management controller that just answers requests to fetch portions of memory, offloading the analysis to a computer with more resources.
- This allows the malware detection engine to be free from modification attempts by malware—there isn't anything the malware can do to disable the “anti-virus” detection since the mechanisms are completely OOB and protected from the application processors.
- Can be used in combination with code running on the application processor—application whitelisting, for example. The application processor can request the management processor to verify the authenticity of some code before running it. This should be more secure than white-listing code running in the kernel on the application processor, which is the current technique being used.
- Isolation of Nodes that have been Security Compromised or are Malfunctioning
- The second embodiment relates to the isolation of nodes that have been security compromised or are malfunctioning. There are cases where, though other known techniques not described herein, a determination has been made that a node needs to be isolated, including:
- A security violation has been detected on a node, including a compromised OS kernel, a root kit, or a damaging virus.
- There are also failure modes, both hardware and software, that could cause a node to fail in such a way that it is causing disruptive traffic on the server fabric.
- Compromise detection is software driven, can come from any source including failures in remote attestation, malware detection, IPS/IDS built into the fabric, or external, manual operator control, management processor DRAM monitoring as discussed in Disclosure 9, and by other known means.
- The following techniques can be used to isolate offending nodes:
- The management processor can power off the application processor, or the offending peripheral.
- The management processor can alter the security zone settings to software isolate the offending device or processor.
- The management processor can alter the fabric MCAM, routing tables, or gateway node IDs to prevent the fabric from emitting potentially compromised packets into the fabric.
- Use the Management Processor to Provide Controller/Device Virtualization for the Application Processors
- The third embodiment relates to the use of the management processor to provide controller/device virtualization for the application processors. The management processor can be used to provide controller or device virtualization for the application processor for both local and remote devices using the following technique:
- Use TrustZone or similar security zones to block access to a device from the application processors, and then have the application processor communicate to the management processor to access it. For example, the application processor could send a NAND read request to the management processor via IPC (Inter-Processor Communication channel), the management processor could approve or disapprove it, and then forward the request to the NAND controller protected in Secure world. The management processor can then return the status of the request to the application processor via IPC. This mechanism can be similarly used for other forms of access control and logging.
- A network firewall, IPS, or IDS can also be implemented via this technique. The management processor can inspect packets before forwarding them to a MAC that is protected via Secure World.
- Trusted Platform Module (TPM) services can similarly be provided by the management processor.
- The management processor can take advantage of the server fabric when deciding what to do with requests to access devices—request remote authorization for example.
- The management processor could log requests either locally or remotely.
- Using the Management Processor to Provide a Secure Logging Path
- The fourth embodiment relates to using the management processor to provide a secure logging path since keeping logs secure for audits is a significant aspect of most regulatory/financial compliance requirements. This can be accomplished using the following technique:
- In traditional systems, the application processor would rely on logging to local storage, network storage, or communicating logging data to a remote server. With this technique, the application processor can send log messages securely to the management processor.
- The logging mechanism of the management processor is thus completely decoupled and secured from the application processor.
- The management processor then has multiple options for persisting the secured logging, including:
- Logging to a central log server via it's secure management fabric domain
- Log locally to private storage to the management processor
- Log to other storage subsystems protected in the Secure trust world, not accessible to the application processor.
- Use the Management Processor to Provide a Secure Auditing Path
- The fifth embodiment relates to the use of the management processor to provide a secure auditing path. Instead of relying on the main network domain to the application processor to perform audits of systems, this technique will utilize the management domain to secure the audit processes.
- Allows network audits to be done securely, in secure network paths.
- As an example, part of an audit may be to perform a port scan of a system. This is relatively low bandwidth—instead of talking directly to the application processor over its normal data path, the request can be proxied via the management processor in a network-proxy type fashion.
- In one implementation, the management processor can do this is a ‘dumb’ method, using techniques such as SNAT (secure network address translation) to ensure the responses are routed back through the management processor instead of out over the fabric.
- Or the management processor can have local auditing control. An example of this implementation may include responding to a port scan request and generate the port scan traffic itself. An additional example is logging in via ssh to verify logs, file integrity, permission integrity, or similar auditing tasks.
- Use the Management Processor to Provide Out-of-Band (OOB) Network Access to the Application Processor
- The sixth embodiment relates to the use of the management processor to provide out-of-band (OOB) network access to the application processor. This technique extends the technique described above by using the management processor as a NATing router using the following technique:
- An application processor may use a Ethernet controller (say MAC0) to communicate in its main ‘data path’—traffic sent out it is routed out via the fabric like normal, at line rate, not touched by the management processor.
- An application processor can further use a second Ethernet controller (say MAC1) to communicate with external hosts via the management processor.
- An extra MAC address can be associated with a node's management processor's MAC port so that any traffic sent to either of two MAC addresses goes to that port.
- One of the MAC addresses can be used for normal IP traffic for the management processor.
- The other can be recognized by special software on the management processor as being destined for the application processor.
- The management processor can then do a NAT type change of the destination MAC address of the packet so that the fabric switch will route it to MAC1, where the application processor will receive it. It can also change the source MAC address to the original destination MAC address of the packet, so that a response to the source MAC address will also be directed to the management processor's MAC.
- The application processor side won't need any special software to support this.
- Could potentially do this on not just the local application processor, but also over the fabric to other nodes. Could use a second application processor instead of the local management processor in that implementation.
- Dynamic Security Zones for DMA Masters
- The seventh embodiment relates to dynamic security zones for direct memory access (DMA) masters. With the ARM TrustZone implementation, as well as other security zone implementations, the DMA Masters, including independent DMA controllers as well as those found embedded in peripheral IP such as disk and ethernet controllers, are configured to either respond to the Secure world or the Normal world. IP vendors either hardwire this setting and don't allow you to change it, or offer a parameter to set it one-way permanently. The following technique extends the fixed relationship of DMA Master's to security zones:
- A security zone register is added between the internal SoC fabric and each DMA master.
- The security zone register is itself protected in Secure world so that untrusted master's can change it.
- The security zone register provides the current security zone to the internal SoC fabric for that transaction.
- This enables use cases including:
- Static configuration of DMA master security zones at boot time. If a thread running in Normal world attempts to access a DMA master that is configured in Secure world than the thread will get an equivalent of a bus abort.
- Ability for trusted hypervisors running in Secure world to dynamically change the visibility of DMA master's depending. This allows for some guest OS's to be able to directly access a DMA master while other's won't have visibility to it.
- Secure Boot-Loading of the Application Processor by the Management Processor
- The eighth embodiment relates to secure boot-loading of the application processor by the management processor. The management processor can bootstrap the application processor by preloading the application processor's boot-loader into DRAM prior to releasing the application processor from reset. This allows the management processor to completely control the contents of the application processors boot-loader, including whether or not the application processor exits secure world immediately and permanently, whether the application processor can selectively enter secure mode, and which interrupts it can service in secure mode only. It also allows the application processor's boot-loader to be cryptographically verified prior to loading it, to ensure the integrity of the boot-loader, or to insure the boot loader was signed by a proper authority. It also allows the application processor's boot loader to be stored in a location inaccessible to the application processor itself, which prevents the application processor from modifying it, while still allowing it to be updated via the management processor's secure channels. The management processor can use its secure management fabric domain to source the application processor's boot-loader dynamically on demand, or can retrieve new versions of it that can be stored in local non-volatile memory.
- DMA Master Configurable Coherency
- The ninth embodiment relates to DMA master configurable coherency. In traditional SoC implementations, a DMA master is designed to be either cache-coherent, or non-coherent. This design usually includes the following characteristics:
- For a cache-coherent implementation, the DMA master is connected to a cache-coherency controller. As an example, in one ARM implementation, the DMA master would be connected via AXI to the Accelerator Coherency Port.
- For a non-cache coherent implementation, the DMA master is connected via the SoC internal fabric directly to the memory subsystem, bypassing the caching subsystem.
- Other common implementation details include design configuration of the DMA master on cacheability configuration.
- Using the technique of this embodiment, a DMA master may be dynamically configured as either coherent or non-coherent using the following technique:
- A software controlled multiplexer may be defined to map the DMA Master to either a coherent port on the cache coherency controller, or directly to the memory subsystem, bypassing the caching subsystem.
- Software controlled register over-rides any hardwired cacheability settings found in the DMA Master IP, so cacheability can be altered when switching between the coherent and non-coherent configuration.
- The cache-coherent and non-coherent interfaces to a DMA controller can affect both the ease of writing the device driver and the resulting performance. But, these tradeoffs can vary by operating system, implementation of the device driver, as well as the devices connected to the DMA master.
- This technique allows a specific hardware/software/system implementation to be optimized at boot-time, rather than hard-wiring the DMA Master coherency decision at SoC design time.
- While the foregoing has been with reference to a particular embodiment of the disclosure, it will be appreciated by those skilled in the art that changes in this embodiment may be made without departing from the principles and spirit of the disclosure, the scope of which is defined by the appended claims.
Claims (21)
Priority Applications (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US14/334,178 US9479463B2 (en) | 2009-10-30 | 2014-07-17 | System and method for data center security enhancements leveraging managed server SOCs |
US15/270,418 US9929976B2 (en) | 2009-10-30 | 2016-09-20 | System and method for data center security enhancements leveraging managed server SOCs |
Applications Claiming Priority (5)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US25672309P | 2009-10-30 | 2009-10-30 | |
US12/794,996 US20110103391A1 (en) | 2009-10-30 | 2010-06-07 | System and method for high-performance, low-power data center interconnect fabric |
US201161489569P | 2011-05-24 | 2011-05-24 | |
US13/475,722 US9077654B2 (en) | 2009-10-30 | 2012-05-18 | System and method for data center security enhancements leveraging managed server SOCs |
US14/334,178 US9479463B2 (en) | 2009-10-30 | 2014-07-17 | System and method for data center security enhancements leveraging managed server SOCs |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US13/475,722 Continuation US9077654B2 (en) | 2009-09-24 | 2012-05-18 | System and method for data center security enhancements leveraging managed server SOCs |
Related Child Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US15/270,418 Continuation US9929976B2 (en) | 2009-10-30 | 2016-09-20 | System and method for data center security enhancements leveraging managed server SOCs |
Publications (2)
Publication Number | Publication Date |
---|---|
US20150074255A1 true US20150074255A1 (en) | 2015-03-12 |
US9479463B2 US9479463B2 (en) | 2016-10-25 |
Family
ID=47217674
Family Applications (3)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US13/475,722 Active US9077654B2 (en) | 2009-09-24 | 2012-05-18 | System and method for data center security enhancements leveraging managed server SOCs |
US14/334,178 Active US9479463B2 (en) | 2009-10-30 | 2014-07-17 | System and method for data center security enhancements leveraging managed server SOCs |
US15/270,418 Active US9929976B2 (en) | 2009-10-30 | 2016-09-20 | System and method for data center security enhancements leveraging managed server SOCs |
Family Applications Before (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US13/475,722 Active US9077654B2 (en) | 2009-09-24 | 2012-05-18 | System and method for data center security enhancements leveraging managed server SOCs |
Family Applications After (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US15/270,418 Active US9929976B2 (en) | 2009-10-30 | 2016-09-20 | System and method for data center security enhancements leveraging managed server SOCs |
Country Status (2)
Country | Link |
---|---|
US (3) | US9077654B2 (en) |
WO (1) | WO2012162314A1 (en) |
Cited By (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10038705B2 (en) | 2015-10-12 | 2018-07-31 | Dell Products, L.P. | System and method for performing intrusion detection in an information handling system |
US20190050021A1 (en) * | 2017-12-29 | 2019-02-14 | Intel IP Corporation | Multichip Reference Logging Synchronization |
US20230328045A1 (en) * | 2022-04-08 | 2023-10-12 | Xilinx, Inc. | Secure shell and role isolation for multi-tenant compute |
Families Citing this family (40)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US8782654B2 (en) | 2004-03-13 | 2014-07-15 | Adaptive Computing Enterprises, Inc. | Co-allocating a reservation spanning different compute resources types |
CA2558892A1 (en) | 2004-03-13 | 2005-09-29 | Cluster Resources, Inc. | System and method for a self-optimizing reservation in time of compute resources |
US20070266388A1 (en) | 2004-06-18 | 2007-11-15 | Cluster Resources, Inc. | System and method for providing advanced reservations in a compute environment |
US8176490B1 (en) | 2004-08-20 | 2012-05-08 | Adaptive Computing Enterprises, Inc. | System and method of interfacing a workload manager and scheduler with an identity manager |
CA2827035A1 (en) | 2004-11-08 | 2006-05-18 | Adaptive Computing Enterprises, Inc. | System and method of providing system jobs within a compute environment |
US8863143B2 (en) | 2006-03-16 | 2014-10-14 | Adaptive Computing Enterprises, Inc. | System and method for managing a hybrid compute environment |
US9231886B2 (en) | 2005-03-16 | 2016-01-05 | Adaptive Computing Enterprises, Inc. | Simple integration of an on-demand compute environment |
CA2603577A1 (en) | 2005-04-07 | 2006-10-12 | Cluster Resources, Inc. | On-demand access to compute resources |
US8041773B2 (en) | 2007-09-24 | 2011-10-18 | The Research Foundation Of State University Of New York | Automatic clustering for self-organizing grids |
US10877695B2 (en) | 2009-10-30 | 2020-12-29 | Iii Holdings 2, Llc | Memcached server functionality in a cluster of data processing nodes |
US11720290B2 (en) | 2009-10-30 | 2023-08-08 | Iii Holdings 2, Llc | Memcached server functionality in a cluster of data processing nodes |
US9066160B2 (en) * | 2011-07-07 | 2015-06-23 | Alcatel Lucent | Apparatus and method for protection in a data center |
US20130191630A1 (en) | 2012-01-24 | 2013-07-25 | Ssh Communications Security Corp | Auditing and controlling encrypted communications |
US9424228B2 (en) * | 2012-11-01 | 2016-08-23 | Ezchip Technologies Ltd. | High performance, scalable multi chip interconnect |
US9820316B2 (en) * | 2013-03-15 | 2017-11-14 | Aerohive Networks, Inc. | Preventing asymmetric routing using network tunneling |
CN103413796B (en) * | 2013-07-16 | 2016-01-06 | 中国科学院计算技术研究所 | The large port interconnection class chip that a kind of substrate multi-chip is integrated and implementation method |
FR3010553B1 (en) | 2013-09-10 | 2015-09-04 | Sagemcom Broadband Sas | METHOD FOR UPDATING A STARTER SOFTWARE OF A MULTIPROCESSOR DEVICE |
WO2015065436A1 (en) | 2013-10-31 | 2015-05-07 | Hewlett-Packard Development Company, L.P. | Target port processing of a data transfer |
KR200476881Y1 (en) * | 2013-12-09 | 2015-04-10 | 네이버비즈니스플랫폼 주식회사 | Booth apparatus for supplying cooling air |
US10776033B2 (en) * | 2014-02-24 | 2020-09-15 | Hewlett Packard Enterprise Development Lp | Repurposable buffers for target port processing of a data transfer |
US9942365B2 (en) * | 2014-03-21 | 2018-04-10 | Fujitsu Limited | Separation and isolation of multiple network stacks in a network element |
US10491467B2 (en) * | 2014-05-23 | 2019-11-26 | Nant Holdings Ip, Llc | Fabric-based virtual air gap provisioning, systems and methods |
US9785801B2 (en) * | 2014-06-27 | 2017-10-10 | Intel Corporation | Management of authenticated variables |
GB2531844B (en) * | 2014-10-31 | 2019-06-26 | Hewlett Packard Development Co | Hardware-protective data processing systems and methods using an application executing in a secure domain |
US9538376B2 (en) | 2014-12-23 | 2017-01-03 | Ssh Communications Security Oyj | Authenticating data communications |
US10037301B2 (en) * | 2015-03-04 | 2018-07-31 | Xilinx, Inc. | Circuits and methods for inter-processor communication |
GB2539428B (en) | 2015-06-16 | 2020-09-09 | Advanced Risc Mach Ltd | Data processing apparatus and method with ownership table |
GB2539429B (en) | 2015-06-16 | 2017-09-06 | Advanced Risc Mach Ltd | Address translation |
GB2539436B (en) * | 2015-06-16 | 2019-02-06 | Advanced Risc Mach Ltd | Secure initialisation |
GB2539435B8 (en) | 2015-06-16 | 2018-02-21 | Advanced Risc Mach Ltd | Data processing memory access control, in which an owning process for a region of memory is specified independently of privilege level |
GB2539433B8 (en) | 2015-06-16 | 2018-02-21 | Advanced Risc Mach Ltd | Protected exception handling |
CN111708717A (en) * | 2015-06-30 | 2020-09-25 | 华为技术有限公司 | Data copying method, direct memory access controller and computer system |
CN106656457A (en) * | 2015-10-30 | 2017-05-10 | 深圳市中兴微电子技术有限公司 | Method, device and system for safe access of data based on VPN |
US10139894B2 (en) * | 2016-04-01 | 2018-11-27 | Platina Systems Corp. | Heterogeneous network in a modular chassis |
US11256641B2 (en) | 2017-01-27 | 2022-02-22 | National Instruments Corporation | Asynchronous start for timed functions |
US20180276175A1 (en) * | 2017-03-22 | 2018-09-27 | National Instruments Corporation | Direct Network Access by a Memory Mapped Peripheral Device for Scheduled Data Transfer on the Network |
US10956832B2 (en) | 2018-06-22 | 2021-03-23 | Platina Systems Corporation | Training a data center hardware instance network |
GB2586279B (en) * | 2019-08-16 | 2022-11-23 | Siemens Ind Software Inc | Routing messages in a integrated circuit chip device |
US10942876B1 (en) | 2019-11-14 | 2021-03-09 | Mellanox Technologies, Ltd. | Hardware engine for configuration register setup |
WO2022040347A1 (en) * | 2020-08-20 | 2022-02-24 | Intrusion, Inc. | System and method for monitoring and securing communications networks and associated devices |
Citations (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20050141424A1 (en) * | 2003-12-24 | 2005-06-30 | Pin Lim | Time-independent deficit round robin method and system |
US20060002311A1 (en) * | 2004-06-30 | 2006-01-05 | Fujitsu Limited | Network device with VLAN topology discovery functions |
US20060179241A1 (en) * | 2005-02-10 | 2006-08-10 | International Business Machines Corporation | Data processing system and method for predictively selecting a scope of broadcast of an operation |
US20060236371A1 (en) * | 2004-12-29 | 2006-10-19 | Fish Andrew J | Mechanism to determine trust of out-of-band management agents |
US20070209072A1 (en) * | 2006-02-27 | 2007-09-06 | Xuemin Chen | Method and system for secure system-on-a-chip architecture for multimedia data processing |
US7664110B1 (en) * | 2004-02-07 | 2010-02-16 | Habanero Holdings, Inc. | Input/output controller for coupling the processor-memory complex to the fabric in fabric-backplane interprise servers |
Family Cites Families (341)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5594908A (en) | 1989-12-27 | 1997-01-14 | Hyatt; Gilbert P. | Computer system having a serial keyboard, a serial display, and a dynamic memory with memory refresh |
US5396635A (en) | 1990-06-01 | 1995-03-07 | Vadem Corporation | Power conservation apparatus having multiple power reduction levels dependent upon the activity of the computer system |
US5451936A (en) | 1991-06-20 | 1995-09-19 | The Johns Hopkins University | Non-blocking broadcast network |
US5781187A (en) | 1994-05-31 | 1998-07-14 | Advanced Micro Devices, Inc. | Interrupt transmission via specialized bus cycle within a symmetrical multiprocessing system |
JPH08123763A (en) | 1994-10-26 | 1996-05-17 | Nec Corp | Memory assigning system for distributed processing system |
US6055618A (en) | 1995-10-31 | 2000-04-25 | Cray Research, Inc. | Virtual maintenance network in multiprocessing system having a non-flow controlled virtual maintenance channel |
US6842430B1 (en) | 1996-10-16 | 2005-01-11 | Koninklijke Philips Electronics N.V. | Method for configuring and routing data within a wireless multihop network and a wireless network for implementing the same |
JP3662378B2 (en) | 1996-12-17 | 2005-06-22 | 川崎マイクロエレクトロニクス株式会社 | Network repeater |
US5908468A (en) | 1997-10-24 | 1999-06-01 | Advanced Micro Devices, Inc. | Data transfer network on a chip utilizing a multiple traffic circle topology |
US5968176A (en) * | 1997-05-29 | 1999-10-19 | 3Com Corporation | Multilayer firewall system |
US5971804A (en) | 1997-06-30 | 1999-10-26 | Emc Corporation | Backplane having strip transmission line ethernet bus |
US6507586B1 (en) | 1997-09-18 | 2003-01-14 | International Business Machines Corporation | Multicast data transmission over a one-way broadband channel |
KR100286375B1 (en) | 1997-10-02 | 2001-04-16 | 윤종용 | Radiator of electronic system and computer system having the same |
US6252878B1 (en) | 1997-10-30 | 2001-06-26 | Cisco Technology, Inc. | Switched architecture access server |
US5901048A (en) | 1997-12-11 | 1999-05-04 | International Business Machines Corporation | Printed circuit board with chip collar |
KR100250437B1 (en) | 1997-12-26 | 2000-04-01 | 정선종 | Path control device for round robin arbitration and adaptation |
US6192414B1 (en) | 1998-01-27 | 2001-02-20 | Moore Products Co. | Network communications system manager |
US8108508B1 (en) | 1998-06-22 | 2012-01-31 | Hewlett-Packard Development Company, L.P. | Web server chip for network manageability |
US6373841B1 (en) | 1998-06-22 | 2002-04-16 | Agilent Technologies, Inc. | Integrated LAN controller and web server chip |
US6181699B1 (en) | 1998-07-01 | 2001-01-30 | National Semiconductor Corporation | Apparatus and method of assigning VLAN tags |
US6314501B1 (en) | 1998-07-23 | 2001-11-06 | Unisys Corporation | Computer system and method for operating multiple operating systems in different partitions of the computer system and for allowing the different partitions to communicate with one another through shared memory |
US6574238B1 (en) | 1998-08-26 | 2003-06-03 | Intel Corporation | Inter-switch link header modification |
CA2369437C (en) | 1999-03-31 | 2008-09-16 | British Telecommunications Public Limited Company | Progressive routing in a communications network |
US20060034275A1 (en) | 2000-05-03 | 2006-02-16 | At&T Laboratories-Cambridge Ltd. | Data transfer, synchronising applications, and low latency networks |
US6711691B1 (en) | 1999-05-13 | 2004-03-23 | Apple Computer, Inc. | Power management for computer systems |
US7970929B1 (en) | 2002-03-19 | 2011-06-28 | Dunti Llc | Apparatus, system, and method for routing data to and from a host that is moved from one location on a communication system to another location on the communication system |
US6442137B1 (en) | 1999-05-24 | 2002-08-27 | Advanced Micro Devices, Inc. | Apparatus and method in a network switch for swapping memory access slots between gigabit port and expansion port |
US7020695B1 (en) | 1999-05-28 | 2006-03-28 | Oracle International Corporation | Using a cluster-wide shared repository to provide the latest consistent definition of the cluster (avoiding the partition-in time problem) |
US6446192B1 (en) | 1999-06-04 | 2002-09-03 | Embrace Networks, Inc. | Remote monitoring and control of equipment over computer networks using a single web interfacing chip |
US6697359B1 (en) | 1999-07-02 | 2004-02-24 | Ancor Communications, Inc. | High performance switch fabric element and switch systems |
US7801132B2 (en) | 1999-11-09 | 2010-09-21 | Synchrodyne Networks, Inc. | Interface system and methodology having scheduled connection responsive to common time reference |
US6857026B1 (en) | 1999-12-14 | 2005-02-15 | Nortel Networks Limited | Using alternate routes for fail-over in a communication network |
US8171204B2 (en) | 2000-01-06 | 2012-05-01 | Super Talent Electronics, Inc. | Intelligent solid-state non-volatile memory device (NVMD) system with multi-level caching of multiple channels |
US6608564B2 (en) | 2000-01-25 | 2003-08-19 | Hewlett-Packard Development Company, L.P. | Removable memory cartridge system for use with a server or other processor-based device |
US20020107903A1 (en) | 2000-11-07 | 2002-08-08 | Richter Roger K. | Methods and systems for the order serialization of information in a network processing environment |
US6990063B1 (en) | 2000-03-07 | 2006-01-24 | Cisco Technology, Inc. | Distributing fault indications and maintaining and using a data structure indicating faults to route traffic in a packet switching system |
US6556952B1 (en) | 2000-05-04 | 2003-04-29 | Advanced Micro Devices, Inc. | Performance monitoring and optimizing of controller parameters |
US7080078B1 (en) | 2000-05-09 | 2006-07-18 | Sun Microsystems, Inc. | Mechanism and apparatus for URI-addressable repositories of service advertisements and other content in a distributed computing environment |
US7143153B1 (en) | 2000-11-09 | 2006-11-28 | Ciena Corporation | Internal network device dynamic health monitoring |
JP2001333091A (en) | 2000-05-23 | 2001-11-30 | Fujitsu Ltd | Communication equipment |
US6816750B1 (en) | 2000-06-09 | 2004-11-09 | Cirrus Logic, Inc. | System-on-a-chip |
US6668308B2 (en) | 2000-06-10 | 2003-12-23 | Hewlett-Packard Development Company, L.P. | Scalable architecture based on single-chip multiprocessing |
US6452809B1 (en) | 2000-11-10 | 2002-09-17 | Galactic Computing Corporation | Scalable internet engine |
US7032119B2 (en) | 2000-09-27 | 2006-04-18 | Amphus, Inc. | Dynamic power and workload management for multi-server system |
US6760861B2 (en) | 2000-09-29 | 2004-07-06 | Zeronines Technology, Inc. | System, method and apparatus for data processing and storage to provide continuous operations independent of device failure or disaster |
US7274705B2 (en) | 2000-10-03 | 2007-09-25 | Broadcom Corporation | Method and apparatus for reducing clock speed and power consumption |
US20020040391A1 (en) | 2000-10-04 | 2002-04-04 | David Chaiken | Server farm formed of systems on a chip |
US7165120B1 (en) | 2000-10-11 | 2007-01-16 | Sun Microsystems, Inc. | Server node with interated networking capabilities |
US6954463B1 (en) | 2000-12-11 | 2005-10-11 | Cisco Technology, Inc. | Distributed packet processing architecture for network access servers |
US7616646B1 (en) | 2000-12-12 | 2009-11-10 | Cisco Technology, Inc. | Intraserver tag-switched distributed packet processing for network access servers |
JP3532153B2 (en) | 2000-12-22 | 2004-05-31 | 沖電気工業株式会社 | Level shifter control circuit |
WO2002069076A2 (en) | 2000-12-29 | 2002-09-06 | Ming Qiu | Server array hardware architecture and system |
US20020097732A1 (en) | 2001-01-19 | 2002-07-25 | Tom Worster | Virtual private network protocol |
US6977939B2 (en) | 2001-01-26 | 2005-12-20 | Microsoft Corporation | Method and apparatus for emulating ethernet functionality over a serial bus |
US7339786B2 (en) | 2001-03-05 | 2008-03-04 | Intel Corporation | Modular server architecture with Ethernet routed across a backplane utilizing an integrated Ethernet switch module |
US7093280B2 (en) * | 2001-03-30 | 2006-08-15 | Juniper Networks, Inc. | Internet security system |
US20030196126A1 (en) | 2002-04-11 | 2003-10-16 | Fung Henry T. | System, method, and architecture for dynamic server power management and dynamic workload management for multi-server environment |
US20020188754A1 (en) | 2001-04-27 | 2002-12-12 | Foster Michael S. | Method and system for domain addressing in a communications network |
US20020161917A1 (en) | 2001-04-30 | 2002-10-31 | Shapiro Aaron M. | Methods and systems for dynamic routing of data in a network |
US7161901B2 (en) | 2001-05-07 | 2007-01-09 | Vitesse Semiconductor Corporation | Automatic load balancing in switch fabrics |
WO2002091672A2 (en) | 2001-05-07 | 2002-11-14 | Vitesse Semiconductor Corporation | A system and a method for processing data packets or frames |
US6766389B2 (en) | 2001-05-18 | 2004-07-20 | Broadcom Corporation | System on a chip for networking |
DE10127198A1 (en) | 2001-06-05 | 2002-12-19 | Infineon Technologies Ag | Physical address provision method for processor system with virtual addressing uses hierarchy mapping process for conversion of virtual address |
US6950895B2 (en) | 2001-06-13 | 2005-09-27 | Intel Corporation | Modular server architecture |
US6501660B1 (en) | 2001-06-22 | 2002-12-31 | Sun Microsystems, Inc. | Reliable card detection in a CPCI system |
US7159017B2 (en) | 2001-06-28 | 2007-01-02 | Fujitsu Limited | Routing mechanism for static load balancing in a partitioned computer system with a fully connected network |
US7200662B2 (en) | 2001-07-06 | 2007-04-03 | Juniper Networks, Inc. | Integrated rule network management system |
US6813676B1 (en) | 2001-07-27 | 2004-11-02 | Lsi Logic Corporation | Host interface bypass on a fabric based array controller |
US6968470B2 (en) | 2001-08-07 | 2005-11-22 | Hewlett-Packard Development Company, L.P. | System and method for power management in a server system |
US6724635B2 (en) | 2001-08-07 | 2004-04-20 | Hewlett-Packard Development Company, L.P. | LCD panel for a server system |
US7325050B2 (en) | 2001-09-19 | 2008-01-29 | Dell Products L.P. | System and method for strategic power reduction in a computer system |
US7337333B2 (en) | 2001-09-19 | 2008-02-26 | Dell Products L.P. | System and method for strategic power supply sequencing in a computer system with multiple processing resources and multiple power supplies |
US6779086B2 (en) | 2001-10-16 | 2004-08-17 | International Business Machines Corporation | Symmetric multiprocessor systems with an independent super-coherent cache directory |
US7447197B2 (en) | 2001-10-18 | 2008-11-04 | Qlogic, Corporation | System and method of providing network node services |
US8325716B2 (en) | 2001-10-22 | 2012-12-04 | Broadcom Corporation | Data path optimization algorithm |
US6963948B1 (en) | 2001-11-01 | 2005-11-08 | Advanced Micro Devices, Inc. | Microcomputer bridge architecture with an embedded microcontroller |
US7310319B2 (en) | 2001-11-02 | 2007-12-18 | Intel Corporation | Multiple-domain processing system using hierarchically orthogonal switching fabric |
US7464016B2 (en) | 2001-11-09 | 2008-12-09 | Sun Microsystems, Inc. | Hot plug and hot pull system simulation |
US7209657B1 (en) | 2001-12-03 | 2007-04-24 | Cheetah Omni, Llc | Optical routing using a star switching fabric |
US7599360B2 (en) | 2001-12-26 | 2009-10-06 | Cisco Technology, Inc. | Methods and apparatus for encapsulating a frame for transmission in a storage area network |
US20030140190A1 (en) | 2002-01-23 | 2003-07-24 | Sun Microsystems, Inc. | Auto-SCSI termination enable in a CPCI hot swap system |
US7340777B1 (en) * | 2003-03-31 | 2008-03-04 | Symantec Corporation | In memory heuristic system and method for detecting viruses |
US7284067B2 (en) | 2002-02-20 | 2007-10-16 | Hewlett-Packard Development Company, L.P. | Method for integrated load balancing among peer servers |
US20030172191A1 (en) | 2002-02-22 | 2003-09-11 | Williams Joel R. | Coupling of CPU and disk drive to form a server and aggregating a plurality of servers into server farms |
US7096377B2 (en) | 2002-03-27 | 2006-08-22 | Intel Corporation | Method and apparatus for setting timing parameters |
US20030202520A1 (en) | 2002-04-26 | 2003-10-30 | Maxxan Systems, Inc. | Scalable switch fabric system and apparatus for computer networks |
US7095738B1 (en) | 2002-05-07 | 2006-08-22 | Cisco Technology, Inc. | System and method for deriving IPv6 scope identifiers and for mapping the identifiers into IPv6 addresses |
US7353530B1 (en) | 2002-05-10 | 2008-04-01 | At&T Corp. | Method and apparatus for assigning communication nodes to CMTS cards |
US7161904B2 (en) * | 2002-06-04 | 2007-01-09 | Fortinet, Inc. | System and method for hierarchical metering in a virtual router based network switch |
US7376125B1 (en) | 2002-06-04 | 2008-05-20 | Fortinet, Inc. | Service processing switch |
US7415723B2 (en) | 2002-06-11 | 2008-08-19 | Pandya Ashish A | Distributed network security system and a hardware processor therefor |
US7453870B2 (en) | 2002-06-12 | 2008-11-18 | Intel Corporation | Backplane for switch fabric |
US7180866B1 (en) | 2002-07-11 | 2007-02-20 | Nortel Networks Limited | Rerouting in connection-oriented communication networks and communication systems |
US7039018B2 (en) | 2002-07-17 | 2006-05-02 | Intel Corporation | Technique to improve network routing using best-match and exact-match techniques |
US7286544B2 (en) | 2002-07-25 | 2007-10-23 | Brocade Communications Systems, Inc. | Virtualized multiport switch |
US7286527B2 (en) | 2002-07-26 | 2007-10-23 | Brocade Communications Systems, Inc. | Method and apparatus for round trip delay measurement in a bi-directional, point-to-point, serial data channel |
US8295288B2 (en) | 2002-07-30 | 2012-10-23 | Brocade Communications System, Inc. | Registered state change notification for a fibre channel network |
US7055044B2 (en) | 2002-08-12 | 2006-05-30 | Hewlett-Packard Development Company, L.P. | System and method for voltage management of a processor to optimize performance and power dissipation |
EP1394985A1 (en) | 2002-08-28 | 2004-03-03 | Siemens Aktiengesellschaft | Test method for network path between network elements in communication networks |
US20110090633A1 (en) | 2002-09-23 | 2011-04-21 | Josef Rabinovitz | Modular sata data storage device assembly |
US7080283B1 (en) | 2002-10-15 | 2006-07-18 | Tensilica, Inc. | Simultaneous real-time trace and debug for multiple processing core systems on a chip |
US8199636B1 (en) | 2002-10-18 | 2012-06-12 | Alcatel Lucent | Bridged network system with traffic resiliency upon link failure |
US7792113B1 (en) | 2002-10-21 | 2010-09-07 | Cisco Technology, Inc. | Method and system for policy-based forwarding |
US6661671B1 (en) | 2002-11-27 | 2003-12-09 | International Business Machines Corporation | Apparatus, method and article of manufacture for determining power permission for a blade spanning power back planes |
US7512788B2 (en) | 2002-12-10 | 2009-03-31 | International Business Machines Corporation | Method and apparatus for anonymous group messaging in a distributed messaging system |
US7917658B2 (en) | 2003-01-21 | 2011-03-29 | Emulex Design And Manufacturing Corporation | Switching apparatus and method for link initialization in a shared I/O environment |
US8024548B2 (en) | 2003-02-18 | 2011-09-20 | Christopher Joseph Daffron | Integrated circuit microprocessor that constructs, at run time, integrated reconfigurable logic into persistent finite state machines from pre-compiled machine code instruction sequences |
US7447147B2 (en) | 2003-02-28 | 2008-11-04 | Cisco Technology, Inc. | Ethernet switch with configurable alarms |
US7039771B1 (en) | 2003-03-10 | 2006-05-02 | Marvell International Ltd. | Method and system for supporting multiple external serial port devices using a serial port controller in embedded disk controllers |
US7216123B2 (en) | 2003-03-28 | 2007-05-08 | Board Of Trustees Of The Leland Stanford Junior University | Methods for ranking nodes in large directed graphs |
US20040215650A1 (en) | 2003-04-09 | 2004-10-28 | Ullattil Shaji | Interfaces and methods for group policy management |
US7047372B2 (en) | 2003-04-15 | 2006-05-16 | Newisys, Inc. | Managing I/O accesses in multiprocessor systems |
US7334064B2 (en) | 2003-04-23 | 2008-02-19 | Dot Hill Systems Corporation | Application server blade for embedded storage appliance |
US20040215991A1 (en) | 2003-04-23 | 2004-10-28 | Dell Products L.P. | Power-up of multiple processors when a voltage regulator module has failed |
US20040215864A1 (en) | 2003-04-28 | 2004-10-28 | International Business Machines Corporation | Non-disruptive, dynamic hot-add and hot-remove of non-symmetric data processing system resources |
US7685254B2 (en) | 2003-06-10 | 2010-03-23 | Pandya Ashish A | Runtime adaptable search processor |
US7400996B2 (en) | 2003-06-26 | 2008-07-15 | Benjamin Thomas Percer | Use of I2C-based potentiometers to enable voltage rail variation under BMC control |
US7512067B2 (en) | 2003-07-21 | 2009-03-31 | Qlogic, Corporation | Method and system for congestion control based on optimum bandwidth allocation in a fibre channel switch |
US7894348B2 (en) | 2003-07-21 | 2011-02-22 | Qlogic, Corporation | Method and system for congestion control in a fibre channel switch |
US7646767B2 (en) | 2003-07-21 | 2010-01-12 | Qlogic, Corporation | Method and system for programmable data dependant network routing |
US7477655B2 (en) | 2003-07-21 | 2009-01-13 | Qlogic, Corporation | Method and system for power control of fibre channel switches |
JP2005041127A (en) | 2003-07-23 | 2005-02-17 | Brother Ind Ltd | Status information notification system, network terminal device and communication processing device |
US7412588B2 (en) | 2003-07-25 | 2008-08-12 | International Business Machines Corporation | Network processor system on chip with bridge coupling protocol converting multiprocessor macro core local bus to peripheral interfaces coupled system bus |
US7353362B2 (en) | 2003-07-25 | 2008-04-01 | International Business Machines Corporation | Multiprocessor subsystem in SoC with bridge between processor clusters interconnetion and SoC system bus |
US7170315B2 (en) | 2003-07-31 | 2007-01-30 | Actel Corporation | Programmable system on a chip |
US7028125B2 (en) | 2003-08-04 | 2006-04-11 | Inventec Corporation | Hot-pluggable peripheral input device coupling system |
US7620736B2 (en) | 2003-08-08 | 2009-11-17 | Cray Canada Corporation | Network topology having nodes interconnected by extended diagonal links |
US20050050334A1 (en) * | 2003-08-29 | 2005-03-03 | Trend Micro Incorporated, A Japanese Corporation | Network traffic management by a virus/worm monitor in a distributed network |
US7934005B2 (en) | 2003-09-08 | 2011-04-26 | Koolspan, Inc. | Subnet box |
WO2005038599A2 (en) | 2003-10-14 | 2005-04-28 | Raptor Networks Technology, Inc. | Switching system with distributed switching fabric |
US7174470B2 (en) | 2003-10-14 | 2007-02-06 | Hewlett-Packard Development Company, L.P. | Computer data bus interface control |
US7415543B2 (en) | 2003-11-12 | 2008-08-19 | Lsi Corporation | Serial port initialization in storage system controllers |
US7109760B1 (en) | 2004-01-05 | 2006-09-19 | Integrated Device Technology, Inc. | Delay-locked loop (DLL) integrated circuits that support efficient phase locking of clock signals having non-unity duty cycles |
JP4248420B2 (en) | 2004-02-06 | 2009-04-02 | 日本電信電話株式会社 | Handover control method for mobile communication network |
US7583661B2 (en) | 2004-03-05 | 2009-09-01 | Sid Chaudhuri | Method and apparatus for improved IP networks and high-quality services |
US7865582B2 (en) | 2004-03-24 | 2011-01-04 | Hewlett-Packard Development Company, L.P. | System and method for assigning an application component to a computing resource |
ITMI20040600A1 (en) | 2004-03-26 | 2004-06-26 | Atmel Corp | DSP SYSTEM ON DOUBLE PROCESSOR WITH MOBILE COMB IN THE COMPLEX DOMAIN |
EP1591906A1 (en) | 2004-04-27 | 2005-11-02 | Texas Instruments Incorporated | Efficient data transfer from an ASIC to a host using DMA |
US7440467B2 (en) | 2004-05-05 | 2008-10-21 | Gigamon Systems Llc | Asymmetric packet switch and a method of use |
US7203063B2 (en) | 2004-05-21 | 2007-04-10 | Hewlett-Packard Development Company, L.P. | Small form factor liquid loop cooling system |
ES2246702B2 (en) | 2004-06-02 | 2007-06-16 | L & M DATA COMMUNICATIONS, S.A. | ETHERNET UNIVERSAL TELECOMMUNICATIONS SERVICE. |
US7467358B2 (en) | 2004-06-03 | 2008-12-16 | Gwangju Institute Of Science And Technology | Asynchronous switch based on butterfly fat-tree for network on chip application |
WO2005125027A1 (en) | 2004-06-15 | 2005-12-29 | Fujitsu Component Limited | Transceiver module |
US7586904B2 (en) | 2004-07-15 | 2009-09-08 | Broadcom Corp. | Method and system for a gigabit Ethernet IP telephone chip with no DSP core, which uses a RISC core with instruction extensions to support voice processing |
US9264384B1 (en) | 2004-07-22 | 2016-02-16 | Oracle International Corporation | Resource virtualization mechanism including virtual host bus adapters |
JP4455206B2 (en) | 2004-07-29 | 2010-04-21 | キヤノン株式会社 | Image forming apparatus and control method thereof |
US7466712B2 (en) | 2004-07-30 | 2008-12-16 | Brocade Communications Systems, Inc. | System and method for providing proxy and translation domains in a fibre channel router |
US7657756B2 (en) * | 2004-10-08 | 2010-02-02 | International Business Machines Corporaiton | Secure memory caching structures for data, integrity and version values |
US7257655B1 (en) | 2004-10-13 | 2007-08-14 | Altera Corporation | Embedded PCI-Express implementation |
EP1805627B1 (en) * | 2004-10-15 | 2011-02-16 | Sony Computer Entertainment Inc. | Methods and apparatus for supporting multiple configurations in a multi-processor system |
US8230144B1 (en) | 2004-10-19 | 2012-07-24 | Broadcom Corporation | High speed multi-threaded reduced instruction set computer (RISC) processor |
US20060090025A1 (en) | 2004-10-25 | 2006-04-27 | Tufford Robert C | 9U payload module configurations |
US7760720B2 (en) | 2004-11-09 | 2010-07-20 | Cisco Technology, Inc. | Translating native medium access control (MAC) addresses to hierarchical MAC addresses and their use |
US7644215B2 (en) | 2004-11-10 | 2010-01-05 | Tekelec | Methods and systems for providing management in a telecommunications equipment shelf assembly using a shared serial bus |
US7278582B1 (en) | 2004-12-03 | 2007-10-09 | Sun Microsystems, Inc. | Hardware security module (HSM) chip card |
US8155113B1 (en) | 2004-12-13 | 2012-04-10 | Massachusetts Institute Of Technology | Processing data in a parallel processing environment |
TWM270514U (en) | 2004-12-27 | 2005-07-11 | Quanta Comp Inc | Blade server system |
US7676841B2 (en) * | 2005-02-01 | 2010-03-09 | Fmr Llc | Network intrusion mitigation |
JP4489030B2 (en) | 2005-02-07 | 2010-06-23 | 株式会社ソニー・コンピュータエンタテインメント | Method and apparatus for providing a secure boot sequence within a processor |
US7467306B2 (en) | 2005-03-08 | 2008-12-16 | Hewlett-Packard Development Company, L.P. | Methods and systems for allocating power to an electronic device |
US7881332B2 (en) | 2005-04-01 | 2011-02-01 | International Business Machines Corporation | Configurable ports for a host ethernet adapter |
JP4591185B2 (en) | 2005-04-28 | 2010-12-01 | 株式会社日立製作所 | Server device |
US7363463B2 (en) | 2005-05-13 | 2008-04-22 | Microsoft Corporation | Method and system for caching address translations from multiple address spaces in virtual machines |
US7586841B2 (en) | 2005-05-31 | 2009-09-08 | Cisco Technology, Inc. | System and method for protecting against failure of a TE-LSP tail-end node |
US7596144B2 (en) | 2005-06-07 | 2009-09-29 | Broadcom Corp. | System-on-a-chip (SoC) device with integrated support for ethernet, TCP, iSCSI, RDMA, and network application acceleration |
WO2006136193A1 (en) | 2005-06-23 | 2006-12-28 | Telefonaktiebolaget L M Ericsson (Publ) | Arrangement and method relating to load distribution |
JP2007012000A (en) | 2005-07-04 | 2007-01-18 | Hitachi Ltd | Storage controller and storage system |
US7461274B2 (en) | 2005-08-23 | 2008-12-02 | International Business Machines Corporation | Method for maximizing server utilization in a resource constrained environment |
US7307837B2 (en) | 2005-08-23 | 2007-12-11 | International Business Machines Corporation | Method and apparatus for enforcing of power control in a blade center chassis |
US7315456B2 (en) | 2005-08-29 | 2008-01-01 | Hewlett-Packard Development Company, L.P. | Configurable IO subsystem |
US8982778B2 (en) | 2005-09-19 | 2015-03-17 | Qualcomm Incorporated | Packet routing in a wireless communications environment |
US7382154B2 (en) | 2005-10-03 | 2008-06-03 | Honeywell International Inc. | Reconfigurable network on a chip |
US8516165B2 (en) | 2005-10-19 | 2013-08-20 | Nvidia Corporation | System and method for encoding packet header to enable higher bandwidth efficiency across bus links |
US7574590B2 (en) | 2005-10-26 | 2009-08-11 | Sigmatel, Inc. | Method for booting a system on a chip integrated circuit |
CN100417118C (en) | 2005-10-28 | 2008-09-03 | 华为技术有限公司 | System and method for renewing network mobile node position in wireless net-like network |
CN2852260Y (en) | 2005-12-01 | 2006-12-27 | 华为技术有限公司 | Server |
EP1808994A1 (en) | 2006-01-12 | 2007-07-18 | Alcatel Lucent | Universal switch for transporting packet data frames |
WO2007084403A2 (en) | 2006-01-13 | 2007-07-26 | Sun Microsystems, Inc. | Compact rackmount storage server |
WO2007084422A2 (en) | 2006-01-13 | 2007-07-26 | Sun Microsystems, Inc. | Modular blade server |
WO2007084735A2 (en) | 2006-01-20 | 2007-07-26 | Avise Partners | Customer service management |
US7991817B2 (en) | 2006-01-23 | 2011-08-02 | California Institute Of Technology | Method and a circuit using an associative calculator for calculating a sequence of non-associative operations |
US20070180310A1 (en) | 2006-02-02 | 2007-08-02 | Texas Instruments, Inc. | Multi-core architecture with hardware messaging |
US7606225B2 (en) | 2006-02-06 | 2009-10-20 | Fortinet, Inc. | Integrated security switch |
US20070226795A1 (en) | 2006-02-09 | 2007-09-27 | Texas Instruments Incorporated | Virtual cores and hardware-supported hypervisor integrated circuits, systems, methods and processes of manufacture |
US20090133129A1 (en) | 2006-03-06 | 2009-05-21 | Lg Electronics Inc. | Data transferring method |
FR2898753B1 (en) | 2006-03-16 | 2008-04-18 | Commissariat Energie Atomique | SEMI-DISTRIBUTED CONTROL CHIP SYSTEM |
US7555666B2 (en) | 2006-05-04 | 2009-06-30 | Dell Products L.P. | Power profiling application for managing power allocation in an information handling system |
JP2007304687A (en) | 2006-05-09 | 2007-11-22 | Hitachi Ltd | Cluster constitution and its control means |
US7660922B2 (en) | 2006-05-12 | 2010-02-09 | Intel Corporation | Mechanism to flexibly support multiple device numbers on point-to-point interconnect upstream ports |
US20070280230A1 (en) | 2006-05-31 | 2007-12-06 | Motorola, Inc | Method and system for service discovery across a wide area network |
US7522468B2 (en) | 2006-06-08 | 2009-04-21 | Unity Semiconductor Corporation | Serial memory interface |
CN101094125A (en) | 2006-06-23 | 2007-12-26 | 华为技术有限公司 | Exchange structure in ATCA / ATCA300 expanded exchange bandwidth |
US7693072B2 (en) | 2006-07-13 | 2010-04-06 | At&T Intellectual Property I, L.P. | Method and apparatus for configuring a network topology with alternative communication paths |
US20080040463A1 (en) | 2006-08-08 | 2008-02-14 | International Business Machines Corporation | Communication System for Multiple Chassis Computer Systems |
CN101127696B (en) | 2006-08-15 | 2012-06-27 | 华为技术有限公司 | Data forwarding method for layer 2 network and network and node devices |
EP1892913A1 (en) | 2006-08-24 | 2008-02-27 | Siemens Aktiengesellschaft | Method and arrangement for providing a wireless mesh network |
US20080052437A1 (en) | 2006-08-28 | 2008-02-28 | Dell Products L.P. | Hot Plug Power Policy for Modular Chassis |
US7802082B2 (en) | 2006-08-31 | 2010-09-21 | Intel Corporation | Methods and systems to dynamically configure computing apparatuses |
US8599685B2 (en) | 2006-09-26 | 2013-12-03 | Cisco Technology, Inc. | Snooping of on-path IP reservation protocols for layer 2 nodes |
US7805575B1 (en) | 2006-09-29 | 2010-09-28 | Tilera Corporation | Caching in multicore and multiprocessor architectures |
US8684802B1 (en) | 2006-10-27 | 2014-04-01 | Oracle America, Inc. | Method and apparatus for balancing thermal variations across a set of computer systems |
US8447872B2 (en) | 2006-11-01 | 2013-05-21 | Intel Corporation | Load balancing in a storage system |
US7992151B2 (en) | 2006-11-30 | 2011-08-02 | Intel Corporation | Methods and apparatuses for core allocations |
CN101681282A (en) | 2006-12-06 | 2010-03-24 | 弗森多系统公司(dba弗森-艾奥) | Be used to share, front end, the device of distributed raid, system and method |
US20080140771A1 (en) | 2006-12-08 | 2008-06-12 | Sony Computer Entertainment Inc. | Simulated environment computing framework |
US20080140930A1 (en) | 2006-12-08 | 2008-06-12 | Emulex Design & Manufacturing Corporation | Virtual drive mapping |
CN101212345A (en) | 2006-12-31 | 2008-07-02 | 联想(北京)有限公司 | Blade server management system |
US8504791B2 (en) | 2007-01-26 | 2013-08-06 | Hicamp Systems, Inc. | Hierarchical immutable content-addressable memory coprocessor |
US8407428B2 (en) | 2010-05-20 | 2013-03-26 | Hicamp Systems, Inc. | Structured memory coprocessor |
US7865614B2 (en) | 2007-02-12 | 2011-01-04 | International Business Machines Corporation | Method and apparatus for load balancing with server state change awareness |
FI120088B (en) | 2007-03-01 | 2009-06-30 | Kone Corp | Arrangement and method of monitoring the security circuit |
US7870907B2 (en) | 2007-03-08 | 2011-01-18 | Weatherford/Lamb, Inc. | Debris protection for sliding sleeve |
JP4370336B2 (en) | 2007-03-09 | 2009-11-25 | 株式会社日立製作所 | Low power consumption job management method and computer system |
US20080239649A1 (en) | 2007-03-29 | 2008-10-02 | Bradicich Thomas M | Design structure for an interposer for expanded capability of a blade server chassis system |
US7783910B2 (en) | 2007-03-30 | 2010-08-24 | International Business Machines Corporation | Method and system for associating power consumption of a server with a network address assigned to the server |
WO2008127672A2 (en) | 2007-04-11 | 2008-10-23 | Slt Logic Llc | Modular blade for providing scalable mechanical, electrical and environmental functionality in the enterprise using advanced tca boards |
JP4815385B2 (en) | 2007-04-13 | 2011-11-16 | 株式会社日立製作所 | Storage device |
US7515412B2 (en) | 2007-04-26 | 2009-04-07 | Enermax Technology Corporation | Cooling structure for power supply |
US7715400B1 (en) | 2007-04-26 | 2010-05-11 | 3 Leaf Networks | Node identification for distributed shared memory system |
DE102007020296A1 (en) | 2007-04-30 | 2008-11-13 | Philip Behrens | Device and method for the wireless production of a contact |
US7925795B2 (en) | 2007-04-30 | 2011-04-12 | Broadcom Corporation | Method and system for configuring a plurality of network interfaces that share a physical interface |
PT103744A (en) | 2007-05-16 | 2008-11-17 | Coreworks S A | ARCHITECTURE OF ACCESS TO THE NETWORK CORE. |
US7552241B2 (en) | 2007-05-18 | 2009-06-23 | Tilera Corporation | Method and system for managing a plurality of I/O interfaces with an array of multicore processor resources in a semiconductor chip |
US7693167B2 (en) | 2007-05-22 | 2010-04-06 | Rockwell Collins, Inc. | Mobile nodal based communication system, method and apparatus |
US8170040B2 (en) | 2007-05-25 | 2012-05-01 | Konda Technologies Inc. | Fully connected generalized butterfly fat tree networks |
US8141143B2 (en) | 2007-05-31 | 2012-03-20 | Imera Systems, Inc. | Method and system for providing remote access to resources in a secure data center over a network |
US8060775B1 (en) | 2007-06-14 | 2011-11-15 | Symantec Corporation | Method and apparatus for providing dynamic multi-pathing (DMP) for an asymmetric logical unit access (ALUA) based storage system |
US7783813B2 (en) | 2007-06-14 | 2010-08-24 | International Business Machines Corporation | Multi-node configuration of processor cards connected via processor fabrics |
JP4962152B2 (en) | 2007-06-15 | 2012-06-27 | 日立電線株式会社 | Opto-electric composite transmission assembly |
US8140719B2 (en) | 2007-06-21 | 2012-03-20 | Sea Micro, Inc. | Dis-aggregated and distributed data-center architecture using a direct interconnect fabric |
EP2009554A1 (en) | 2007-06-25 | 2008-12-31 | Stmicroelectronics SA | Method for transferring data from a source target to a destination target, and corresponding network interface |
US7761687B2 (en) | 2007-06-26 | 2010-07-20 | International Business Machines Corporation | Ultrascalable petaflop parallel supercomputer |
US8060760B2 (en) | 2007-07-13 | 2011-11-15 | Dell Products L.P. | System and method for dynamic information handling system prioritization |
US7688578B2 (en) | 2007-07-19 | 2010-03-30 | Hewlett-Packard Development Company, L.P. | Modular high-density computer system |
US8150019B2 (en) | 2007-08-10 | 2012-04-03 | Smith Robert B | Path redundant hardware efficient communications interconnect system |
US7840703B2 (en) | 2007-08-27 | 2010-11-23 | International Business Machines Corporation | System and method for dynamically supporting indirect routing within a multi-tiered full-graph interconnect architecture |
US20090063747A1 (en) | 2007-08-28 | 2009-03-05 | Rohati Systems, Inc. | Application network appliances with inter-module communications using a universal serial bus |
US20090080428A1 (en) * | 2007-09-25 | 2009-03-26 | Maxxan Systems, Inc. | System and method for scalable switch fabric for computer network |
US20090251867A1 (en) | 2007-10-09 | 2009-10-08 | Sharma Viswa N | Reconfigurable, modularized fpga-based amc module |
US7739475B2 (en) | 2007-10-24 | 2010-06-15 | Inventec Corporation | System and method for updating dirty data of designated raw device |
US7822841B2 (en) | 2007-10-30 | 2010-10-26 | Modern Grids, Inc. | Method and system for hosting multiple, customized computing clusters |
EP2061191A1 (en) | 2007-11-13 | 2009-05-20 | STMicroelectronics (Grenoble) SAS | Buffering architecture for packet injection and extraction in on-chip networks. |
US8068433B2 (en) | 2007-11-26 | 2011-11-29 | Microsoft Corporation | Low power operation of networked devices |
US7877622B2 (en) | 2007-12-13 | 2011-01-25 | International Business Machines Corporation | Selecting between high availability redundant power supply modes for powering a computer system |
US7962771B2 (en) | 2007-12-31 | 2011-06-14 | Intel Corporation | Method, system, and apparatus for rerouting interrupts in a multi-core processor |
US20090168374A1 (en) | 2008-01-02 | 2009-07-02 | Clayton James E | Thin multi-chip flex module |
US7779148B2 (en) | 2008-02-01 | 2010-08-17 | International Business Machines Corporation | Dynamic routing based on information of not responded active source requests quantity received in broadcast heartbeat signal and stored in local data structure for other processor chips |
US20090204834A1 (en) | 2008-02-11 | 2009-08-13 | Nvidia Corporation | System and method for using inputs as wake signals |
US20090204837A1 (en) | 2008-02-11 | 2009-08-13 | Udaykumar Raval | Power control system and method |
US8854831B2 (en) | 2012-04-10 | 2014-10-07 | Arnouse Digital Devices Corporation | Low power, high density server and portable device for use with same |
US8082400B1 (en) | 2008-02-26 | 2011-12-20 | Hewlett-Packard Development Company, L.P. | Partitioning a memory pool among plural computing nodes |
US8156362B2 (en) | 2008-03-11 | 2012-04-10 | Globalfoundries Inc. | Hardware monitoring and decision making for transitioning in and out of low-power state |
TWI354213B (en) | 2008-04-01 | 2011-12-11 | Inventec Corp | Server |
US20090259864A1 (en) | 2008-04-10 | 2009-10-15 | Nvidia Corporation | System and method for input/output control during power down mode |
US8762759B2 (en) | 2008-04-10 | 2014-06-24 | Nvidia Corporation | Responding to interrupts while in a reduced power state |
US8169896B2 (en) | 2008-04-16 | 2012-05-01 | Telefonaktiebolaget Lm Ericsson (Publ) | Connectivity fault management traffic indication extension |
US7742844B2 (en) | 2008-04-21 | 2010-06-22 | Dell Products, Lp | Information handling system including cooling devices and methods of use thereof |
JP5075727B2 (en) | 2008-04-25 | 2012-11-21 | 株式会社日立製作所 | Stream distribution system and failure detection method |
US7725603B1 (en) | 2008-04-30 | 2010-05-25 | Network Appliance, Inc. | Automatic network cluster path management |
US7861110B2 (en) | 2008-04-30 | 2010-12-28 | Egenera, Inc. | System, method, and adapter for creating fault-tolerant communication busses from standard components |
US7921315B2 (en) | 2008-05-09 | 2011-04-05 | International Business Machines Corporation | Managing power consumption in a data center based on monitoring circuit breakers |
US20090282419A1 (en) | 2008-05-09 | 2009-11-12 | International Business Machines Corporation | Ordered And Unordered Network-Addressed Message Control With Embedded DMA Commands For A Network On Chip |
US9391874B2 (en) | 2008-05-12 | 2016-07-12 | Telefonaktiebolaget L M Ericsson (Publ) | Re-routing traffic in a communications network |
WO2009140631A2 (en) | 2008-05-15 | 2009-11-19 | Smooth-Stone, Inc. | Distributed computing system with universal address system and method |
US20100008038A1 (en) | 2008-05-15 | 2010-01-14 | Giovanni Coglitore | Apparatus and Method for Reliable and Efficient Computing Based on Separating Computing Modules From Components With Moving Parts |
US8775718B2 (en) | 2008-05-23 | 2014-07-08 | Netapp, Inc. | Use of RDMA to access non-volatile solid-state memory in a network storage system |
US7519843B1 (en) | 2008-05-30 | 2009-04-14 | International Business Machines Corporation | Method and system for dynamic processor speed control to always maximize processor performance based on processing load and available power |
US7904345B2 (en) | 2008-06-10 | 2011-03-08 | The Go Daddy Group, Inc. | Providing website hosting overage protection by transference to an overflow server |
US8244918B2 (en) | 2008-06-11 | 2012-08-14 | International Business Machines Corporation | Resource sharing expansion card |
IL192140A0 (en) | 2008-06-12 | 2009-02-11 | Ethos Networks Ltd | Method and system for transparent lan services in a packet network |
US8886985B2 (en) | 2008-07-07 | 2014-11-11 | Raritan Americas, Inc. | Automatic discovery of physical connectivity between power outlets and IT equipment |
CN102150103A (en) | 2008-07-14 | 2011-08-10 | 加利福尼亚大学董事会 | Architecture to enable energy savings in networked computers |
US20100026408A1 (en) | 2008-07-30 | 2010-02-04 | Jeng-Jye Shau | Signal transfer for ultra-high capacity circuits |
US8031703B2 (en) | 2008-08-14 | 2011-10-04 | Dell Products, Lp | System and method for dynamic maintenance of fabric subsets in a network |
US8132034B2 (en) | 2008-08-28 | 2012-03-06 | Dell Products L.P. | System and method for managing information handling system power supply capacity utilization based on load sharing power loss |
US8804710B2 (en) | 2008-12-29 | 2014-08-12 | Juniper Networks, Inc. | System architecture for a scalable and distributed multi-stage switch fabric |
JP5428267B2 (en) | 2008-09-26 | 2014-02-26 | 富士通株式会社 | Power supply control system and power supply control method |
US8484493B2 (en) | 2008-10-29 | 2013-07-09 | Dell Products, Lp | Method for pre-chassis power multi-slot blade identification and inventory |
US8068482B2 (en) | 2008-11-13 | 2011-11-29 | Qlogic, Corporation | Method and system for network switch element |
US10255463B2 (en) | 2008-11-17 | 2019-04-09 | International Business Machines Corporation | Secure computer architecture |
JP5151924B2 (en) | 2008-11-19 | 2013-02-27 | 富士通株式会社 | Power management proxy device, server device, server power management method using proxy device, proxy device power management program, server device power management program |
US20100161909A1 (en) | 2008-12-18 | 2010-06-24 | Lsi Corporation | Systems and Methods for Quota Management in a Memory Appliance |
US20100158005A1 (en) | 2008-12-23 | 2010-06-24 | Suvhasis Mukhopadhyay | System-On-a-Chip and Multi-Chip Systems Supporting Advanced Telecommunication Functions |
US20100169479A1 (en) | 2008-12-26 | 2010-07-01 | Electronics And Telecommunications Research Institute | Apparatus and method for extracting user information using client-based script |
US8122269B2 (en) | 2009-01-07 | 2012-02-21 | International Business Machines Corporation | Regulating power consumption in a multi-core processor by dynamically distributing power and processing requests by a managing core to a configuration of processing cores |
US8775544B2 (en) | 2009-02-04 | 2014-07-08 | Citrix Systems, Inc. | Methods and systems for dynamically switching between communications protocols |
US8510744B2 (en) | 2009-02-24 | 2013-08-13 | Siemens Product Lifecycle Management Software Inc. | Using resource defining attributes to enhance thread scheduling in processors |
GB2468137A (en) | 2009-02-25 | 2010-09-01 | Advanced Risc Mach Ltd | Blade server with on board battery power |
JP5816407B2 (en) | 2009-02-27 | 2015-11-18 | ルネサスエレクトロニクス株式会社 | Semiconductor integrated circuit device |
US8725946B2 (en) | 2009-03-23 | 2014-05-13 | Ocz Storage Solutions, Inc. | Mass storage system and method of using hard disk, solid-state media, PCIe edge connector, and raid controller |
US8140871B2 (en) | 2009-03-27 | 2012-03-20 | International Business Machines Corporation | Wake on Lan for blade server |
TWI358016B (en) | 2009-04-17 | 2012-02-11 | Inventec Corp | Server |
US8127128B2 (en) | 2009-05-04 | 2012-02-28 | International Business Machines Corporation | Synchronization of swappable module in modular system |
TWM377621U (en) | 2009-05-25 | 2010-04-01 | Advantech Co Ltd | Interface card with hardware monitor and function extension, computer device and single board |
US8004922B2 (en) | 2009-06-05 | 2011-08-23 | Nxp B.V. | Power island with independent power characteristics for memory and logic |
US9001846B2 (en) | 2009-06-09 | 2015-04-07 | Broadcom Corporation | Physical layer device with dual medium access controller path |
US8321688B2 (en) | 2009-06-12 | 2012-11-27 | Microsoft Corporation | Secure and private backup storage and processing for trusted computing and data services |
WO2011008215A1 (en) | 2009-07-17 | 2011-01-20 | Hewlett-Packard Development Company, L.P. | Virtual hot inserting functions in a shared i/o environment |
CN101989212B (en) | 2009-07-31 | 2015-01-07 | 国际商业机器公司 | Method and device for providing virtual machine management program for starting blade server |
US8340120B2 (en) | 2009-09-04 | 2012-12-25 | Brocade Communications Systems, Inc. | User selectable multiple protocol network interface device |
US20110103391A1 (en) | 2009-10-30 | 2011-05-05 | Smooth-Stone, Inc. C/O Barry Evans | System and method for high-performance, low-power data center interconnect fabric |
US9876735B2 (en) | 2009-10-30 | 2018-01-23 | Iii Holdings 2, Llc | Performance and power optimized computer system architectures and methods leveraging power optimized tree fabric interconnect |
US8599863B2 (en) | 2009-10-30 | 2013-12-03 | Calxeda, Inc. | System and method for using a multi-protocol fabric module across a distributed server interconnect fabric |
US9054990B2 (en) | 2009-10-30 | 2015-06-09 | Iii Holdings 2, Llc | System and method for data center security enhancements leveraging server SOCs or server fabrics |
US9465771B2 (en) | 2009-09-24 | 2016-10-11 | Iii Holdings 2, Llc | Server on a chip and node cards comprising one or more of same |
TW201112936A (en) | 2009-09-29 | 2011-04-01 | Inventec Corp | Electronic device |
US8903964B2 (en) | 2009-10-05 | 2014-12-02 | Vss Monitoring, Inc. | Auto-configuration of network captured traffic device |
US8194659B2 (en) | 2009-10-06 | 2012-06-05 | Red Hat, Inc. | Mechanism for processing messages using logical addresses |
US8571031B2 (en) | 2009-10-07 | 2013-10-29 | Intel Corporation | Configurable frame processing pipeline in a packet switch |
US9311269B2 (en) | 2009-10-30 | 2016-04-12 | Iii Holdings 2, Llc | Network proxy for high-performance, low-power data center interconnect fabric |
US9680770B2 (en) | 2009-10-30 | 2017-06-13 | Iii Holdings 2, Llc | System and method for using a multi-protocol fabric module across a distributed server interconnect fabric |
US9767070B2 (en) | 2009-11-06 | 2017-09-19 | Hewlett Packard Enterprise Development Lp | Storage system with a memory blade that generates a computational result for a storage device |
US20110119344A1 (en) | 2009-11-17 | 2011-05-19 | Susan Eustis | Apparatus And Method For Using Distributed Servers As Mainframe Class Computers |
US20110191514A1 (en) | 2010-01-29 | 2011-08-04 | Inventec Corporation | Server system |
WO2011093288A1 (en) | 2010-02-01 | 2011-08-04 | 日本電気株式会社 | Network system, controller, and network control method |
TW201128395A (en) | 2010-02-08 | 2011-08-16 | Hon Hai Prec Ind Co Ltd | Computer motherboard |
US20110210975A1 (en) | 2010-02-26 | 2011-09-01 | Xgi Technology, Inc. | Multi-screen signal processing device and multi-screen system |
US8397092B2 (en) | 2010-03-24 | 2013-03-12 | Emulex Design & Manufacturing Corporation | Power management for input/output devices by creating a virtual port for redirecting traffic |
KR101641108B1 (en) | 2010-04-30 | 2016-07-20 | 삼성전자주식회사 | Target device providing debugging functionality and test system comprising the same |
US8045328B1 (en) | 2010-05-04 | 2011-10-25 | Chenbro Micom Co., Ltd. | Server and cooler moduel arrangement |
US8880468B2 (en) | 2010-07-06 | 2014-11-04 | Nicira, Inc. | Secondary storage architecture for a network control system that utilizes a primary network information base |
US8812400B2 (en) | 2010-07-09 | 2014-08-19 | Hewlett-Packard Development Company, L.P. | Managing a memory segment using a memory virtual appliance |
EP2608462B1 (en) | 2010-08-20 | 2019-02-06 | Nec Corporation | Communication system, control apparatus, communication method and program |
CN102385417B (en) | 2010-08-25 | 2013-02-20 | 英业达股份有限公司 | Rack-mounted server |
JP2012053504A (en) | 2010-08-31 | 2012-03-15 | Hitachi Ltd | Blade server device |
US8601288B2 (en) | 2010-08-31 | 2013-12-03 | Sonics, Inc. | Intelligent power controller |
GB2497493B (en) | 2010-09-16 | 2017-12-27 | Iii Holdings 2 Llc | Performance and power optimized computer system architectures and methods leveraging power optimized tree fabric interconnect |
US20120081850A1 (en) | 2010-09-30 | 2012-04-05 | Dell Products L.P. | Rack Assembly for Housing and Providing Power to Information Handling Systems |
US8699220B2 (en) | 2010-10-22 | 2014-04-15 | Xplore Technologies Corp. | Computer with removable cartridge |
US8738860B1 (en) | 2010-10-25 | 2014-05-27 | Tilera Corporation | Computing in parallel processing environments |
DE102011056141A1 (en) | 2010-12-20 | 2012-06-21 | Samsung Electronics Co., Ltd. | A negative voltage generator, decoder, non-volatile memory device and memory system using a negative voltage |
US20120198252A1 (en) | 2011-02-01 | 2012-08-02 | Kirschtein Phillip M | System and Method for Managing and Detecting Server Power Connections |
US8670450B2 (en) | 2011-05-13 | 2014-03-11 | International Business Machines Corporation | Efficient software-based private VLAN solution for distributed virtual switches |
US8547825B2 (en) | 2011-07-07 | 2013-10-01 | International Business Machines Corporation | Switch fabric management |
US8683125B2 (en) | 2011-11-01 | 2014-03-25 | Hewlett-Packard Development Company, L.P. | Tier identification (TID) for tiered memory characteristics |
US9565132B2 (en) | 2011-12-27 | 2017-02-07 | Intel Corporation | Multi-protocol I/O interconnect including a switching fabric |
US8782321B2 (en) | 2012-02-08 | 2014-07-15 | Intel Corporation | PCI express tunneling over a multi-protocol I/O interconnect |
US20130290650A1 (en) | 2012-04-30 | 2013-10-31 | Jichuan Chang | Distributed active data storage system |
US20130290643A1 (en) | 2012-04-30 | 2013-10-31 | Kevin T. Lim | Using a cache in a disaggregated memory architecture |
US20140165196A1 (en) | 2012-05-22 | 2014-06-12 | Xockets IP, LLC | Efficient packet handling, redirection, and inspection using offload processors |
US9304896B2 (en) | 2013-08-05 | 2016-04-05 | Iii Holdings 2, Llc | Remote memory ring buffers in a cluster of data processing nodes |
-
2012
- 2012-05-18 US US13/475,722 patent/US9077654B2/en active Active
- 2012-05-22 WO PCT/US2012/038987 patent/WO2012162314A1/en active Application Filing
-
2014
- 2014-07-17 US US14/334,178 patent/US9479463B2/en active Active
-
2016
- 2016-09-20 US US15/270,418 patent/US9929976B2/en active Active
Patent Citations (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20050141424A1 (en) * | 2003-12-24 | 2005-06-30 | Pin Lim | Time-independent deficit round robin method and system |
US7664110B1 (en) * | 2004-02-07 | 2010-02-16 | Habanero Holdings, Inc. | Input/output controller for coupling the processor-memory complex to the fabric in fabric-backplane interprise servers |
US20060002311A1 (en) * | 2004-06-30 | 2006-01-05 | Fujitsu Limited | Network device with VLAN topology discovery functions |
US20060236371A1 (en) * | 2004-12-29 | 2006-10-19 | Fish Andrew J | Mechanism to determine trust of out-of-band management agents |
US20060179241A1 (en) * | 2005-02-10 | 2006-08-10 | International Business Machines Corporation | Data processing system and method for predictively selecting a scope of broadcast of an operation |
US20070209072A1 (en) * | 2006-02-27 | 2007-09-06 | Xuemin Chen | Method and system for secure system-on-a-chip architecture for multimedia data processing |
Cited By (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10038705B2 (en) | 2015-10-12 | 2018-07-31 | Dell Products, L.P. | System and method for performing intrusion detection in an information handling system |
US20190050021A1 (en) * | 2017-12-29 | 2019-02-14 | Intel IP Corporation | Multichip Reference Logging Synchronization |
US10747259B2 (en) * | 2017-12-29 | 2020-08-18 | Intel IP Corporation | Multichip reference logging synchronization |
US20230328045A1 (en) * | 2022-04-08 | 2023-10-12 | Xilinx, Inc. | Secure shell and role isolation for multi-tenant compute |
Also Published As
Publication number | Publication date |
---|---|
WO2012162314A1 (en) | 2012-11-29 |
US9077654B2 (en) | 2015-07-07 |
US20170012899A1 (en) | 2017-01-12 |
US20120297043A1 (en) | 2012-11-22 |
US9479463B2 (en) | 2016-10-25 |
US9929976B2 (en) | 2018-03-27 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US9929976B2 (en) | System and method for data center security enhancements leveraging managed server SOCs | |
US10050970B2 (en) | System and method for data center security enhancements leveraging server SOCs or server fabrics | |
US11893409B2 (en) | Securing a managed forwarding element that operates within a data compute node | |
US20210344692A1 (en) | Providing a virtual security appliance architecture to a virtual cloud infrastructure | |
US8800025B2 (en) | Integrated virtual desktop and security management system | |
US8194667B2 (en) | Method and system for inheritance of network interface card capabilities | |
US20110103391A1 (en) | System and method for high-performance, low-power data center interconnect fabric | |
US20110274110A1 (en) | Method for preventing mac spoofs in a distributed virtual switch | |
US10491522B2 (en) | Data plane integration | |
WO2007134023A2 (en) | Portable firewall | |
US10911405B1 (en) | Secure environment on a server | |
US11240204B2 (en) | Score-based dynamic firewall rule enforcement | |
US20180048562A1 (en) | Network Processor Inter-Device Packet Source ID Tagging for Domain Security | |
US20120198542A1 (en) | Shared Security Device | |
CN114008979B (en) | Serverless packet processing service with isolated virtual network integration | |
US11711292B2 (en) | Pre-filtering of traffic subject to service insertion | |
US12003429B2 (en) | Dual user space-kernel space datapaths for packet processing operations | |
Papastefanakis et al. | A mixed criticality approach for the security of critical flows in a network-on-chip | |
US20230153270A1 (en) | Data criticality-based network policy creation and consumption | |
US20230066013A1 (en) | Dual user space-kernel space datapaths for packet processing operations | |
Fragkiadakis | An active router architecture using programmable hardware |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: III HOLDINGS 2, LLC, DELAWARE Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:SILICON VALLEY BANK;REEL/FRAME:033551/0683 Effective date: 20140630 |
|
STCF | Information on status: patent grant |
Free format text: PATENTED CASE |
|
MAFP | Maintenance fee payment |
Free format text: PAYMENT OF MAINTENANCE FEE, 4TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1551); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY Year of fee payment: 4 |
|
MAFP | Maintenance fee payment |
Free format text: PAYMENT OF MAINTENANCE FEE, 8TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1552); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY Year of fee payment: 8 |